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Abstract 

This paper gives the first separation of quantum and classical pure (i.e., non-cryptographic) computing 
abilities with no restriction on the amount of available computing resources, by considering the exact solv- 
ability of a celebrated unsolvable problem in classical distributed computing, the "leader election problem" 
in anonymous networks. The goal of the leader election problem is to elect a unique leader from among 
distributed parties. The paper considers this problem for anonymous networks, in which each party has the 
same identifier. It is well-known that no classical algorithm can solve exactly (i.e., in bounded time without 
error) the leader election problem in anonymous networks, even if it is given the number of parties. This 
paper gives two quantum algorithms that, given the number of parties, can exactly solve the problem for 
any network topology in polynomial rounds and polynomial communication/time complexity with respect 
to the number of parties, when the parties are connected by quantum communication links. The two algo- 
rithms each have their own characteristics with respect to complexity and the property of the networks they 
can work on. Our first algorithm offers much lower time and communication complexity than our second 
one, while the second one is more general than the first one in that the second one can run even on any 
network, even those whose underlying graph is directed, whereas the first one works well only on those 
with undirected graphs. Moreover, our algorithms work well even in the case where only the upper bound 
of the number of parties is given. No classical algorithm can solve the problem even with zero error (i.e., 
without error but possibly in unbounded running time) in such cases, if the upper bound may be more than 
twice the number of parties. In order to keep the complexity of the second algorithm polynomially bounded, 
a new classical technique is developed; the technique quadratically improves the previous bound on the 
number of rounds required to compute a Boolean function on anonymous networks, without increasing the 
communication complexity. 



1 Introduction 

1.1 Background 

Quantum computation and communication are turning out to be much more powerful than the classical equiva- 
lents in various computational tasks. Perhaps the most exciting developments in quantum computation would be 
polynomial-time quantum algorithms for factoring integers and computing discrete logarithms [39] ; these give 
a separation of quantum and classical computation in terms of the amount of computational resource required 
to solve the problems, on the assumption that the problems are hard to solve in polynomial-time with classical 
algorithms. From a practical point of view, the algorithms also have a great impact on the real cryptosystems 

*A preliminary version of this paper appeared in [44]. 
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used in E-commerce, since most of them assume the hardness of integer factoring or discrete logarithms for 
their security. 

Many other algorithms such as Grover's search [26, 14, 35] and quantum walk [18, 4], and protocols [17, 
37, 16, 9] have been proposed to give separations in terms of the amount of computational resources (e.g., 
computational steps, communicated bits or work space) needed to compute some functions. 

From the view point of computability, there are many results on languages recognizable by quantum au- 
tomata [6, 2, 47, 7, 46]; they showed that there are some languages that quantum automata can recognize 
but their classical counterparts cannot. This gives the separation of quantum and classical models in terms of 
computability, instead of in terms of the amount of required computational resources, when placing a sort of 
restriction on computational ability (i.e., the number of internal states) of the models. 

In the cryptographic field, the most remarkable quantum result would be the quantum key distribution pro- 
tocols [13, 12] that have been proved unconditionally secure [32, 40, 41, 42, 43]. In contrast, no unconditionally 
secure key distribution protocol is possible in classical settings. Many other studies demonstrate the superiority 
of quantum computation and communication for cryptography [23, 3, 20, 19, 10, 5, 11] 

This paper gives the first separation of quantum and classical abilities for a pure (i.e., non-cryptographic) 
computational task with no restriction on the amount of available computing resources; its key advance is to 
consider the exact solvability of a celebrated unsolvable problem in classical distributed computing, the "leader 
election problem" in anonymous networks. 

The leader election problem is a core problem in traditional distributed computing in the sense that, once it 
is solved, it becomes possible to efficiently solve many substantial problems in distributed computing such as 
finding the maximum value and constructing a spanning tree (see, e.g., [31]). The goal of the leader election 
problem is to elect a unique leader from among distributed parties. When each party has a unique identifier, 
the problem can be deterministically solved by selecting the party that has the largest identifier as the leader; 
many classical deterministic algorithms in this setting have been proposed [22, 36, 25, 24, 45]. As the number 
of parties grows, however, it becomes difficult to preserve the uniqueness of the identifiers. Thus, other studies 
have examined the cases wherein each party is anonymous, i.e., each party has the same identifier [8, 28, 48, 49], 
as an extreme case. In this setting, every party has to be in a common initial state and run a common algorithm; if 
there are two parties who are in different initial states or who run different algorithms, they can be distinguished 
by regarding their initial states or algorithms as their identifiers. A simple algorithm meets this condition: 
initially, all parties are eligible to be the unique leader, and repeats common subroutines that drop eligible 
parties until only one party is eligible. In the subroutines, (1) every eligible party independently generates a 
random bit, (2) all parties then collaborate to check if all eligible parties have the same bit, and (3) if not, 
the eligible parties having bit "0" are made ineligible (otherwise nothing changes). Thus, the problems can 
be solved probabilistically. Obviously, there is a positive probability that all parties get identical values from 
independent random number generators. In fact, the problem cannot be solved exactly (i.e., in bounded time and 
with zero error) on networks having symmetric structures such as rings, even if every party can have unbounded 
computational power or perform analogue computation with infinite precision. The situation is unchanged if 
every party is allowed to share infinitely many random strings. Strictly speaking, no classical exact algorithm 
(i.e., an algorithm that runs in bounded time and solves the problem with zero error) exists for a broad class of 
network topologies including regular graphs, even if the network topology (and thus the number of parties) is 
known to each party prior to algorithm invocation [48]. Moreover, no classical zero-error algorithm exists in 
such cases for any topology that has a cycle as its subgraph [28], if every party can get only the upper bound of 
the number of the parties. 
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1.2 Our Results 



This paper considers the distributed computing model in which the network is anonymous and consists of 
quantum communication links,* and gives two exact quantum algorithms both of which, given the number 
of parties, elect a unique leader from among n parties in polynomial time for any topology of synchronous 
networks (note that no party knows the topology of the network). Throughout this paper, by time complexity 
we mean the maximum number of steps, including steps for the local computation, necessary for each party to 
execute the protocol, where the maximum is taken over all parties. In synchronous networks, the number of 
simultaneous message passings is also an important measure. Each turn of simultaneous message passing is 
referred to as a round. 

We first summarize our results before giving explanations of our algorithms. Outlines of our algorithms are 
given in subsection 1.3. 

Our first algorithm, "Algorithm I," runs in 0(n 3 ) time. The total communication complexity of this algo- 
rithm is 0(n 4 ), which includes the quantum communication of 0(n 4 ) qubits. More precisely, we prove the next 
theorem. 

Theorem 1 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given n, the number of parties, Algorithm I exactly elects a unique leader in 0(n 2 ) rounds and 0(Dn 2 ) 
time. Each party connected with d parties requires 0(dn 2 )-qubit communication, and the total communication 
complexity over all parties is 0(\E\n 2 ). 

The first algorithm works in a similar way to the simple probabilistic algorithm described the above, except 
that the first algorithm can reduce the number of parties even in the situations corresponding to the classical 
cases where all eligible parties obtain the same values. 

Our second algorithm, "Algorithm II," is more general than the first one in that the second one can work 
even on any network, even those whose underlying graph is directed and strongly-connected 1 " while the first one 
cannot. Roughly speaking, the first algorithm has to invert parts of the quantum computation and communica- 
tion already performed to erase garbage for subsequent computation; this inverting operation is hard to perform 
on directed networks (except for some special cases), i.e., it demands communication links be bidirectional in 
general. In contrast, the second algorithm does not have to perform such inverting operations. Another desir- 
able property is that the second algorithm needs less quantum communication than the first one; since sending 
a qubit would cost more than sending a classical bit, reducing the quantum communication complexity is de- 
sirable. Our second algorithm incurs 0(« 6 (log n) 2 ) time complexity, but demands the quantum communication 
of only 0(n 2 log n) qubits (plus classical communication of 0(n 6 (log n) 2 ) bits). The second algorithm is also 
superior to the first one in terms of round complexity. While the first algorithm needs 0(n 2 ) rounds of quantum 
communication, the second algorithm needs only one round of quantum communication at the beginning of the 
protocol to share a sufficient amount of entanglement, and after the first round, the protocol performs only local 
quantum operations and classical communications (LOCCs) of 0(n log n) rounds. More precisely, we prove the 
next theorem. 

Theorem 2 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given the number n of parties, Algorithm II exactly elects a unique leader in 0(Dn 5 (log n) 2 ) time and 
0(n log n) rounds of which only the first round requires quantum communication. The total communication 
complexity over all parties is 0(D\E\n 3 (log D) log n) which includes the communication of only 0(\E\logn) 
qubits. 

Algorithms I and II are easily modified to allow their use in asynchronous networks. We summarize the 
complexity of the two algorithms in Table 1. 

'Independently, quantum leader election in the broadcast model was studied in [21], 

f Note that it is natural to assume that the underlying graph is strongly-connected when it is a directed graph; otherwise there is a 
party that can know the information of only a part of the network. 
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Table 1 : Complexity of the two algorithms for n, the number of parties 





Time 


Quantum Communication 


Total Communication 


Round 


Algorithm I 


0(« 4 ) 


0(« 4 ) 


0(« 4 ) 


0(n z ) 


Algorithm II 


0{n\\ogn) 2 ) 


0{n l ) 


0{n\\ogn) 1 ) 


0(n log n) 



Furthermore, both algorithms can be modified so that they work well even when each party initially knows 
only the upper bound N of the number n of parties. For Algorithm I, each party has only to perform the 
algorithm with N instead of n. The complexity is described simply by replacing every n by N. 

Corollary 3 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given N, the number of parties, Algorithm I exactly elects a unique leader in 0(N 2 ) rounds and 0(DN 2 ) 
time. Each party connected with d parties requires 0(dN 2 )-qubit communication, and the total communication 
complexity over all parties is 0(\E\N 2 ). 

Algorithm II strongly depends on counting the exact number of eligible parties and this requires knowledge 
of the exact number of parties. Thus, we cannot apply Algorithm II as it is, when each party initially knows 
only the upper bound Nofn; We need considerable elaboration to modify Algorithm II. We call this variant of 
Algorithm II Generalized Algorithm II. 

Corollary 4 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given N, the upper bound of the number of parties, Generalized Algorithm II exactly elects a unique 
leader in 0(DN 6 (log N) 2 ) time and 0(N log N) rounds of which only the first round requires quantum commu- 
nication. The total communication complexity over all parties is 0(D\E\N 4 (\og D) log N) which includes the 
communication of only 0(\E\N\ogN) qubits. 

These corollaries imply that the exact number of parties can be computed when its upper bound is given. 
No classical zero-error algorithm exists in such cases for any topology that has a cycle as its subgraph [28]. 

In general, most quantum algorithms use well-known techniques such as the quantum amplitude amplifi- 
cation [14] and the quantum Fourier transform [39], as building blocks. In contrast, our algorithms use quite 
new quantum operations in combination with (improvements of) classical techniques. The quantum operations 
are be interesting in their own right and may have the potential to trigger the development of other tools that 
can elucidate the advantage of quantum computing over the classical computing. The folded view we shall 
introduce later in this paper in Algorithm II can be used to compute any (computable) Boolean function with 
distributed inputs on anonymous networks, as used in [30], when every party knows the number of parties but 
not the topology of the network; this quadratically decreases the number of rounds needed without increasing 
the communication complexity. More precisely, an «-bit Boolean function can be computed by using folded 
view with 0(n) rounds of classical communication of 0(n 6 log n) bits, while the algorithm in [30] computes the 
function in 0(n 2 ) rounds with the same amount of classical communication (their second algorithm can com- 
pute a symmetric Boolean function with lower communication complexity, i.e., 0(n 5 (logn) 2 ), and 0(n 3 log«) 
rounds, but it requires that every party knows the topology of the network). From a technical viewpoint, folded 
view is a generalization of Ordered Binary Decision Diagrams (OBDD) [15], which are used in commercial 
VLSI CAD systems as data structures to process Boolean functions; folded view would be interesting in its 
own right. 

From a practical point of view, classical probabilistic algorithms would do in many situations, since they 
are expected to run with the sufficiently small time/communication complexity. Furthermore, our model does 
not allow any noise on the communication links and our algorithms use unitary operators whose matrices have 
elements depending for the problem of n parties. In practical environments, in which communication 

noise is inevitable and all physical devices have some limits to their precision, our algorithms cannot avoid 
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errors. In this sense, our algorithm would be fully theoretical and in a position to reveal a new aspect of 
quantum distributed computing. From a theoretical point of view, however, no classical computation (including 
analog computation) with a finite amount of resources can exactly solve the problem when given the number of 
parties, and solve even with zero error when given only the upper bound of the number of parties; our results 
demonstrate examples of significant superiority in computability of distributed quantum computing over its 
classical counterpart in computability, beyond the reduction of communication cost. To the best knowledge 
of the authors, this is the first separation of quantum and classical pure (i.e., non-cryptographic) computing 
abilities with no restriction on the amount of available computing resources. 

1.3 Outline of the Algorithms 

1.3.1 Algorithm I 

The algorithm repeats one procedure exactly (n - 1) times, each of which is called a phase. Intuitively, a phase 
corresponds to a coin flip. 

In each phase i, let 5,- c {1 n) be the set of all Zs such that party Z is still eligible. First, each eligible 

party prepares the state (|0> + |1»/ V2 in one-qubit register Ro, instead of generating a random bit, while each 
ineligible party prepares the state |0) in Ro- Every party then collaborates to check in a superposition if all 
eligible parties have the same content in Ro. They then store the result into another one-qubit register S, 
followed by inversion of the computation and communication performed for this checking in order to erase 
garbage. (This inverting step makes it impossible for the algorithm to work on directed networks.) After 
measuring S, exactly one of the two cases is chosen by the laws of quantum mechanics: the first case is that 
the qubits of all eligible parties' Ro are in a quantum state that superposes the classical situations where all 
eligible parties do not have the same bit, and the second case is that the qubits are in a state that superposes the 
complement situations, i.e., cat-state (lO)® 15,1 + |l>® |5il )/ V2 for set 5, of eligible parties. Note that the ineligible 
parties' qubits in Ro are not entangled. 

In the first case, every eligible party measures Ro and gets a classical bit. Since this corresponds to one of 
the classical situations superposed in the quantum state in which all eligible parties do not have the same bit, 
this always reduces the number of the eligible parties. In the second case, however, every eligible party would 
get the same bit if he measured Ro- To overcome this, we introduce two families of novel unitary operations: 
{Uk} and {Vk}- Suppose that the current phase is the Zth one. Every eligible party then performs U\ or 
depending on whether k - (n - i + 1) is even or odd. We prove that, if (n - i + 1) equals the resulting state 
superposes the classical states in which all eligible parties do not have the same values; eligible parties can be 
reduced by using the values obtained by the measurement. If (n — i + 1) + the resulting quantum state 
may include a classical state in which all parties have the same values; the set of eligible parties may not be 
changed by using the measurement results. (To make this step work, we erase the garbage after computing the 
data stored into S.) It is clear from the above that k is always at least in each phase i, since k is n - \S\ \ in 
the first phase and is decreased by 1 after each phase. It follows that exactly one leader is elected after the last 
phase. 

1.3.2 Algorithm II 

The algorithm consists of two stages, Stages 1 and 2. Stage 1 aims to have the n parties share a certain type of 
entanglement, and thus, this stage requires the parties to exchange quantum messages. In Stage 1, every party 
exchanges only one message to share s pure quantum states \<p^), . . . , \<f>^) of n qubits. Here, each is of 
the form (|x (,) > + |x w ))/ V2 for an rc-bit string and its bitwise negation x w , and the Zth qubit of each is 
possessed by the Zth party. 

Stage 2 selects a unique leader from among the n parties only by LOCCs, with the help of the shared 
entanglement prepared in Stage 1. This stage consists of at most s phases, each of which reduces the number 
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of eligible parties by at least half, and maintains variable k that represents the number of eligible parties. At the 
beginning of Stage 2, k is set to n (i.e., the number of all parties). Let 5,- c {1, ...,«} be the set of all h such 
that party / is still eligible just before entering phase i. First every party exchanges classical messages to decide 
if all eligible parties have the same content for state or not. 

If so, the parties transform |0 (,) > into the |S,-|-cat state (|0}® |5il + |l) 0|Sil )/ V2 shared only by eligible parties 
and then use Ut and Vu as in Algorithm I to obtain a state that superposes the classical states in which all 
eligible parties do not have the same values. 

Each party I then measures his qubits to obtain a label and find the minority among all parties' labels. The 
number of eligible parties is then reduced by at least half via minority voting with respect to the labels. The 
updated number of eligible parties is set to k. 

To count the exact number of eligible parties that have a certain label, we make use of a classical technique, 
called view [48, 50]. However, a naive application of view incurs exponential classical time/communication 
complexity, since view is essentially a tree that covers the underlying graph, G, of the network, i.e., the universal 
cover of G [34]. To keep the complexity moderate, we introduce the new technique of folded view, with which 
the algorithm still runs in time/communication polynomial with respect to the number of parties. 

To generalize Algorithm II so that it can work given the upper bound of the number of the parties, we 
modify Algorithm II so that it can halt in at most [log N~\ phases even when it is given the wrong number of 
parties as input, and it can output "error" when it concludes that the leader has not been elected yet after the last 
phase. The basic idea is to simultaneously run N— 1 processes of the modified algorithm, each of which is given 
2, 3, . . . , N, respectively, as the number of parties. Let M be the largest oie (2,3,...,iV| such that the process of 
the modified algorithm for m terminates with output "eligible" or "ineligible" (i.e., without outputting "error"). 
We will prove that M is equal to the hidden number of parties, i.e., n, and thus the process for M elects the 
unique leader. We call this Generalized Algorithm II. 

1.4 Organization of the Paper 

Section 2 defines the network model and the leader election problem in an anonymous network. Section 3 first 
gives Algorithm I when the number of parties is given to every party, and then generalizes it to the case where 
only the upper bound of the number of parties is given. Section 4 describes Algorithm II when the number of 
parties is given to every party, and also its generalization for the case where only the upper bound of the number 
of parties is given. Algorithm II is first described on undirected networks just for ease of understanding, and 
then modified so that it can work well when the underlying graph is directed and strongly-connected. Section 5 
defines folded view and proves that every party can construct it and extract from it the number of parties that 
have some specified value in polynomial time and communication cost. Finally, section 6 concludes the paper. 

2 Preliminaries 

2.1 Quantum Computation 

Here we briefly introduce quantum computation (for more detailed introduction, see [33, 29]). A unit of quan- 
tum information corresponding to a bit is called a qubit. A pure quantum state (or simply a pure state) of the 
quantum system consisting of n qubits is a vector of unit-length in the 2" -dimensional Hilbert space. For any 
basis (|So), . . . , |S2«_i)} of the space, any pure state can be represented by 

2"-l 
1=0 

where complex number a,, called amplitude, holds l«/l 2 = 1- There is a simple basis in which every basis 
state \Bi) corresponds to one of the 2" possible classical positions in the space: (jo, i\, i n -\) € {0, 1}". We 
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often denote |B,-> by 

|io>®|ii>®--®|i»-i>, 



\io)\h)---\i n -i), 

or 

\ioh ■ ■ ■ i n -i)- 

This basis is called the computational basis. 

If the quantum system is measured with respect to any basis {Bo, . . . , B2"-iK the probability of observing 
basis state |B,) is \a^. As a result of the measurement, the state is projected onto the observed basis state. 
Measurement can also be performed on a part of the system or some of the qubits forming the system. For 
example, let Y^=q 1 a i\Bi) be |0o)|O> + |0i)|l). If we measure the last qubit with respect to basis (|0>, |1», we 
obtain |0> with probability ((f>o\<f>o) and |1> with probability (<f>i\(f>i), where ((p\4>) is the inner product of vectors 
\<p) and \4>), and the first n - 1 qubits collapse to |0o)/ ^(<Po\<Po) an d \<fi\)l ^(<Pi\<t>i), respectively. In the same 
way, we may measure the system with respect to other bases. In particular, we will use the Hadamard basis 
{|+>, |-M of the 2-dimensional Hilbert space, where |+> = -j=(\0) + \l)) and |-> = ^=(|0)-|1». If Yj = ~ l o^is 
expressed as |0+)|+) + |0_)|->, by measuring the last qubit with respect to the Hadamard basis, we observe |+> 
with probability ((f> + \(f> + ) and |-> with probability (0_|0->, and the post-measurement states are \(f>+)/ tJ(4>+\<1>+) 
and -^(0-10-), respectively. 

In order to perform computation over the quantum system, we want to apply transformations to the state of 
the system. The laws of quantum mechanics permit only unitary transformations over the Hilbert space. These 
transformations are represented by unitary matrices, where a unitary matrix is one whose conjugate transpose 
equals its inverse. 

2.2 The distributed network model 

A distributed system (or network) is composed of multiple parties and bidirectional classical communication 
links connecting parties. In a quantum distributed system, every party can perform quantum computation and 
communication, and each adjacent pair of parties has a bidirectional quantum communication link between 
them. When the parties and links are regarded as nodes and edges, respectively, the topology of the distributed 
system is expressed by an undirected connected graph, denoted by G - (V, E). In what follows, we may identify 
each party/link with its corresponding node/edge in the underlying graph for the system, if it is not confusing. 
Every party has ports corresponding one-to-one to communication links incident to the party. Every port of 
party I has a unique label i, 1 < i < di, where di is the number of parties adjacent to /. More formally, G has 
a port numbering, which is a set cr of functions {o~[v] | v € V] such that, for each node v of degree d v , cr[v] 
is a bijection from the set of edges incident to v to {1, 2, ... , d v ). It is stressed that each function cr[v] may be 
defined independently of the others. Just for ease of explanation, we assume that port i corresponds to the link 
connected to the ith adjacent party of party /. In our model, each party knows the number of his ports and can 
appropriately choose one of his ports whenever he transmits or receives a message. 

Initially, every party has local information, such as his local state, and global information, such as the 
number of nodes in the system (or an upper bound). Every party runs the same algorithm, which has local and 
global information as its arguments. If all parties have the same local and global information except for the 
number of ports they have, the system is said to be anonymous. This is essentially equivalent to the situation 
in which every party has the same identifier since we can regard the local/global information of the party as his 
identifier. 

Traditionally, distributed system are either synchronous or asynchronous. In the synchronous case, mes- 
sage passing is performed synchronously. The unit interval of synchronization is called a round, which is the 
combination of the following two steps [31], where the two functions that generate messages and change local 
states are defined by the algorithm invoked by each party: (1) each party changes the local state as a function 
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of the current local state and the incoming messages, and removes the messages from the ports; (2) each party 
generates messages and decides ports through which the messages should be sent as another function of the 
current local state, and sends the messages via the ports. If message passing is performed synchronously, a 
distributed system is called synchronous. 

2.3 Leader election problem in anonymous networks 

The leader election problem is formally defined as follows. 

Definition 5 (Leader Election Problem (LE n )) Suppose that there is an n-party distributed system with un- 
derlying graph G, and that each party i e {1,2, . . . ,«} in the system has a variable x,- initialized to some 
constant c,-. Create the situation in which x/, — 1 for only one ofk £ {1,2, ... ,n] and X{ = Ofor every i in the 
rest { 1,2, ...,«} \{lc\. 

When each party i has his own unique identifier, i.e., c; e {1,2, . . . ,n) such that c; + cj for i + j, LE„ can 
be deterministically solved in Q(n) rounds in the synchronous case and &(n log n) rounds in the asynchronous 
case [31]. 

When Ci - Cj for all i and j (i + j), the parties are said to be anonymous and the distributed system 
(network) consisting of anonymous parties is also said to be anonymous. The leader election problem in an 
anonymous network was first investigated by Angluin [8]. Her model allows any two adjacent parties can 
collaborate to toss a coin to decide a winner: one party receives a bit "1" (winner) if and only if the other 
party receives a bit "0" (loser), as the result of the coin toss Among the two parties, thus, a leader can exactly 
be elected, where "exactly" means "in bounded time and without error." Even in her model, she showed that 
there are infinitely many topologies of anonymous networks for which no algorithms exist that can exactly 
solve the problem, and gave a necessary and sufficient condition in terms of graph covering for exactly solving 
the leader election problem. In the usual anonymous network model which does not assume such coin-tossing 
between adjacent parties, Yamashita and Kameda [48] proved that, if the "symmetricity" (defined in [48]) of 
the network topology is more than one, LE„ cannot be solved exactly (more rigorously speaking, there are some 
port numberings for which LE„ cannot be solved exactly) by any classical algorithm even if all parties know 
the topology of the network (and thus the number of parties). The condition that symmetricity of more than one 
implies that, a certain port numbering satisfies that, for any party i, there is an automorphism on the underlying 
graph with the port numbering that exchanges i and another party /'. This condition holds for a broad class of 
graphs, including regular graphs. Formally, the symmetricity is defined later by using "views." 

Since it is impossible in many cases to exactly solve the problem in the classical setting, many prob- 
abilistic algorithms have benn proposed. Itai and Rodeh [27, 28] gave a zero-error algorithm for a syn- 
chronous/asynchronous unidirectional ring of size n; it is expected to take 0(n)/0(n\ogn) rounds with the 
communication of 0(n)/0(n log n) bits. 

When every party knows only the upper bound of the number of the parties, which is at most twice the exact 
number, Itai and Rodeh [28] showed that the problem can still be solved with zero error on a ring. However, 
if the given upper bound can be more than twice the exact number of the parties, they showed that there is no 
zero-error classical algorithm for a ring. This impossibility result can be extended to a general topology having 
cycles. They also proved that there is a bounded-error algorithm for a ring, given an upper bound of the number 
of parties. 

Schieber and Snir [38] gave bounded-error algorithms for any topology even when no information on the 
number of parties is available, although no party can detect the termination of the algorithms (such algo- 
rithms are called message termination algorithms). Subsequently, Afek and Matias [1] described more efficient 
bounded-error message termination algorithms. 

Yamashita and Kameda [50] examined the case in which every party is allowed to send messages only via 
the broadcast channel and/or to receive messages only via their own mailboxes (i.e., no party can know which 
port was used to send and/or receive messages). 



8 



3 Quantum leader election algorithm I 



For simplicity, we assume that the network is synchronous and each party knows the number of parties, n, prior 
to algorithm invocation. It is easy to generalize our algorithm to the asynchronous case and to the case where 
only the upper bound N of the number of parties is given, as will be discussed at the end of this section. 

Initially, all parties are eligible to become the leader. The key to solving the leader election problem in an 
anonymous network is to break symmetry, i.e., to have some parties possess a certain state different from those 
of the other parties. 

First we introduce the concept of consistent and inconsistent strings. Suppose that each party / has c-bit 
string xi (i.e., the n parties share era-bit string x = x\X2 ■ ■ ■ x n ). For convenience, we may consider that each xi 
expresses an integer, and identify string xi with the integer it expresses. Given a set S c {1, . . . ,«}, string x is 
said to be consistent over S if x/ has the same value for all I in S . Otherwise, x is said to be inconsistent over 
S . We also say that the cra-qubit pure state = Y^x a x\x) shared by the ra parties is consistent (inconsistent) 
over S if a x t only for x's that are consistent (inconsistent) over 5 . Note that there are states that are neither 
consistent nor inconsistent (i.e., states which are in a superposition of consistent and inconsistent states). By 
m-cat state, we mean the pure state of the form of (lO)®" 1 + |l)® m )/ V2, for positive integer m. When we apply 
the operator of the form 

X "vl'//>l°> ^ 2 a j\nj)\nj) 
j j 

for the computational basis ||ra ; )} over the Hilbert space of known dimensions, we just say "copy" if it is not 
confusing. 

3.1 The algorithm 

The algorithm repeats one procedure exactly (ra - 1) times, each of which is called a phase. In each phase, the 
number of eligible parties either decreases or remains the same, but never increases or becomes zero. After 
(ra - 1) phases, the number of eligible parties becomes one with certainty. 

Each phase has a parameter denoted by k, whose value is (n - i + 1) in phase i. In each phase i, let 
Si c {1, . . . ,«} be the set of all Is such that party / is still eligible. First, each eligible party prepares the state 
(|0> + 1 1 »/ V2 in register Ro, while each ineligible party prepares the state |0> in Ro- Next every party calls 
Subroutine A, followed by partial measurement. This transforms the system state, i.e., the state in all parties' 
R s into either (\0)® lSil + ll)® 15,1 ) ® \Q)®( n -\ s M / V2 or a state that is inconsistent over S t , where the first \Si\ qubits 
represent the qubits in the eligible parties' Ros. In the former case, each eligible party calls Subroutine B, 
which uses a new ancilla qubit in register Ri. If k equals Subroutine B always succeeds in transforming 
the |5;|-cat state in the eligible parties' Ros into a 2|5;|-qubit state that is inconsistent over Si by using the 
ancilla qubits. In the latter case, each eligible party simply initializes the qubit in Ri to state |0). Now, each 
eligible party / measures his qubits in Ro and Ri in the computational basis to obtain (a binary expression of) 
some two-bit integer zi- Parties then compute the maximum value of zi over all eligible parties /, by calling 
Subroutine C. Finally, parties with the maximum value remain eligible, while the other parties become ineligi- 
ble. More precisely, each party I having d[ adjacent parties performs Algorithm I which is described in Figure 1 
with parameters "eligible," n, and <i/. The party who obtains the output "eligible" is the unique leader. Precise 
descriptions of Subroutines A, B, and C are to be found in subsections 3.2, 3.3, and 3.4, respectively. 

3.2 Subroutine A 

Subroutine A is essentially for the purpose of checking the consistency over 5, of each string that is superposed 
in the quantum state shared by the parties. We use commute operator "o" over set S = {0, l,*,x} whose 
operations are summarized in Table 2. Intuitively, "0" and "1" represent the possible values all eligible parties 
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Algorithm I 

Input: a classical variable status e {"eligible", "ineligible"), integers n, d 
Output: a classical variable status € {"eligible", "ineligible") 

1. Prepare one-qubit quantum registers Ro, Ri, and S. 

2. For k := n down to 2, do the following: 

2.1 If status = "eligible," prepare the states (|0> + |1»/ V2 and |"consistent"> in Ro and S, otherwise 
prepare the states |0> and |"consistent") in Ro and S. 

2.2 Perform Subroutine A with Ro, S, status, n, and d. 

2.3 Measure the qubit in S in the {|"consistent">, ["inconsistent"}} basis. 

If this results in |"consistent"> and status = "eligible," prepare the state |0> in Ri and perform 
Subroutine B with Ro, Ri, and k; 

otherwise if this results in ("inconsistent"), just prepare the state |0> in R\. 

2.4 If status = "eligible," measure the qubits in Ro and Ri in the {|0), |1)} basis to obtain the nonnegative 
integer z expressed by the two bits; otherwise let z := -1. 

2.5 Perform Subroutine C with z, n, and d to know the maximum value z max of z over all parties. 
If z + Zmax, let status := "ineligible." 

3. Output status. 



Figure 1 : Quantum leader election algorithm I. 

will have when the string finally turns out to be consistent; "*" represents "don't care," which means that 
the corresponding party has no information on the values possessed by eligible parties; and "x" represents 
"inconsistent," which means that the corresponding party already knows that the string is inconsistent. Although 
Subroutine A is essentially a trivial modification of the algorithm in [30] to handle the quantum case, we give 
a precise description of Subroutine A in Figure 2 for completeness. 

As one can see from the description of Algorithm I, the content of S is "consistent" whenever Subroutine A 
is called. Therefore, after every party finishes Subroutine A, the state shared by parties in their Ros is decom- 
posed into a consistent state for which each party has the content "consistent" in his S, and an inconsistent 
state for which each party has the content "inconsistent" in his S. Steps 4 and 5 are performed to disentangle 
work quantum registers x| ?) s from the rest. 

The next two lemmas prove the correctness and complexity of Subroutine A. 

Lemma 6 Suppose that n parties share n-qubit state = I^ =0 ~ 1 ai\i) in n one-qubit registers ~Rqs, where ajS 
are any complex numbers such that Yn=Q l \ a i\ 2 - 1- Suppose, moreover, that each party runs Subroutine A 
with the following objects as input: (1) Ro, and another one-qubit quantum register S, which is initialized to 
| "consistent"), (2) a classical variable status e {eligible, ineligible), (3) n and the number d of neighbors of 
the party. Let S be the set of indices of parties whose status is "eligible." Subroutine A then outputs Ro and S 
such that the qubits in all parties' Ros and Si are in the state ^ = Q l {aj\i) ® \sj)® n ), where Si is "consistent" if 
\i) is consistent over S, and "inconsistent" otherwise. 

Proof Subroutine A just superposes an application of a reversible classical algorithm to each basis state. Fur- 
thermore, no interference occurs since the contents of Ros are never changed during the execution of the sub- 
routine. Thus, it is sufficient to prove the correctness of Subroutine A when the content of Ro is a classical bit. 
It is stressed that all ancilla qubits used as work space can be disentangled by inverting every communication 
and computation. 

Suppose that we are given one-bit classical registers Ro and S, classical variable status, and integers n and 
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Table 2: The definition of commute operator "o." 
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d. For any party / and a positive integer t, the content of Xq j is set to Xq { o x^ o ••• o x^\ in step 2.3, where 

X^J is X ( p of party /, and xfj is the content of X^j. For any /, by expanding this recurrence relation, the content 

of X^j can be expressed in the form of x^ o ••• o x^j for some m < (n - l) (n_1) . Since the diameter of the 

underlying graph is at most n — I, there is at least one x 0[ , in x^ , . . . , x Ql for each /'. Thus x^ o • • • o x Q[ is 

equal to x \ o x Q 2 o • • • o x Qn , since o is commutative and associative, and x o x = x for any x € {0, 1, *, x}. 

Therefore, we can derive the following facts: (1) if and only if there are both and 1 in the contents of Rqs 
of all parties, Subroutine A outputs S ='x', which will be taken as "inconsistent"; (2) if and only if there are 
either 0's or l's but not both in the contents of Ros (which possibly include '*'), Subroutine A outputs S ='0' 
or '1', respectively, which are both taken into "consistent." □ 



Lemma 7 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respectively. 
Subroutine A takes 0(n) rounds and 0(Dn) time. The total communication complexity over all parties is 0(\E\n). 

Proof Since step 3 takes constant time and steps 4 and 5 are just the inversions of steps 2 and 1, respectively, it 
is sufficient to consider steps 1 and 2. Step 1 takes at most O(Dn) time. For each t, steps 2. 1 and 2. 1 take 0(D) 
time, and step 2.3 can compute xl o jq o • • • o x 9 in 0(D) time by performing each o one-by-one from left to 
right. Hence step 2 takes 0(Dn) time. It follows that Subroutine A takes 0(Dn) time in total. 

As for the number of rounds and communication complexity, it is sufficient to consider just step 2, since 
only steps 2 and 4 involve communication and step 4 is the inversion of step 2. It is easy to see that the number 
of rounds is 0(n). As for communication complexity, every party sends two qubits via each link for each 
iteration in step 2. Hence every party needs to send 0(nD) qubits in step 2. By summing up the number of 
qubits sent over all parties, the communication complexity is 0(\E\n). □ 



3.3 Subroutine B 

Suppose that, among n parties, k parties are still eligible and share the &-cat state flO) 8 * + V2 in their 

Ro's. Subroutine B has the goal of transforming the k-cat state to an inconsistent state with certainty by 
using k fresh ancilla qubits that are initialized to |0), when k is given. Figure 3 gives a precise description 
of Subroutine B, where [Uk\ and {Vt} are two families of unitary operators, 
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Subroutine A 

Input: one-qubit quantum registers Ro, S, a classical variable status e {"eligible", "ineligible"), integers n, d 
Output: one-qubit quantum registers Ro and S 

1. Prepare two-qubit quantum registers X^\ . . . , X ( j\ . . . , X " _1) , . . . , X^ _1) , X Q n) . 

If status = "eligible," copy the content of R to X 1} ; otherwise set the content of X^ to "*." 

2. For t :- 1 to n - 1, do the following: 

2.1 Copy the content of X® to each of xf, Xf. 

2.2 Exchange the qubit in X ( p with the party connected via port i for 1 < i < d (i.e., the original qubit 
in X^ is sent via port i, and the qubit received via that port is newly set in X^). 

2.3 Set the content of X Q ?+1) to o o ■ ■ ■ o where denotes the content of X^ for < i < d. 

in) 

3. If the content of X Q is "x," turn the content of S over (i.e., if the content of S is "consistent," it is flipped 
to "inconsistent," and vice versa). 

4. Invert every computation and communication in Step 2. 

5. Invert every computation in Step 1. 

6. Output quantum registers Rq and S. 



Figure 2: Subroutine A. 



Subroutine B 

Input: one-qubit quantum registers Ro, Ri, an integer k 
Output: one-qubit quantum registers Ro, Ri 

1. If k is even, apply Uu to the qubit in Ro; otherwise copy the content in Ro to that in Ri, and then apply 
Vic to the qubits in Ro and Ri . 

2. Output quantum registers Ro and Ri . 



Figure 3: Subroutine B. 
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where and 4 are the real and imaginary parts of e 1 ^ , respectively. 

The point is that the amplitudes of the states 100)®*, 101)®*, IIO) 8 *, and |1 1)®* shared by k eligible parties in 
their registers R and Ri are simultaneously zero after every eligible party applies Subroutine B with parameter 
k, if the qubits in Ros of all eligible parties form the &-cat state. The next two lemmas describe this rigorously. 

Instead of Uu, we give a proof for a more general case. 



Lemma 8 Suppose that k parties each have one of k-cat-state qubits for any even integer k>2. After every 
party applies 

1 ( e W- 2 -¥n) 

u k ty,t) = —y_ e _ m _w n) e _„ 
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to his qubit, the resulting k-qubit state is inconsistent over the set of the indices of the k parties, where if/ and t 
are any fixed real and integer values, respectively. 



Proof Uk(if/,t) is unitary since Ui c (if',t)Ui !: (i//,tf = Uk(iff,t)^Uk(iff,t) = I, where Ukiif/J)^ is the adjoint of 
Uk(if/, t), and / is the two-dimensional identity operator. It is sufficient to prove that the amplitudes of states 
10)®* and II)®* are both zero after every party applies Ut(if/, i) to his &-cat-state qubit. 
After every party applies t40A, t), the amplitude of state |0)®* is 



1 



+ 



V2 



The amplitude of state |1>®* is 



1 



V2 



V2 



= 0, 



since k is even. 



Corollary 9 Suppose that k parties each have one of the k qubits that are in a k-cat-state for any even integer 
k>2. After every party applies U^® I to the qubit and afresh ancilla qubit, the resulting 2k-qubit state is 
inconsistent over S, where S is the set of the indices of the k parties. 

Proof By setting both if/ and t to in Lemma 8, the proof is completed. □ 



The case for Vjt can be proved similarly. 

Lemma 10 Suppose that k parties each have two of the 2k qubits that are in a 2k-cat-state for any odd integer 
k > 3. After every party applies Vu to his two qubits, the resulting 2k-qubit state is inconsistent over S , where 
S is the set of indices of the k parties. 

Proof The matrix of Vt is well-defined since the denominator in any element of Vt is positive since + 1 > 
and R2k > for k > 3. We can verify that Vt is unitary by some calculation. 

To complete the proof, we will show that the amplitudes of states |00>®*, |01>®*, |10>®*, and 111)®* are all 
zero after every party applies Vjt to his two qubits, since these states imply that all parties observe the same 
two-bit value by measuring their two qubits. Here we assume that the ordering of the 2k qubits is such that 
party / has the (21 - l)st and 2/th qubits for / = 1, 2, . . . , k. 

After every party applies Vt, the amplitude of state |00)®* is 

1 / 1 \ / e'k 



+ =0. 



V2 [\ y/Wk + 1)/ \ V2(** + 1) 
In the same way, the amplitudes of states |01)®* and |10)®* are 

\k 
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Subroutine C 

Input: integers z, n, d 
Output: an integer z max 

1. Let Zmax - = Z- 

2. For t := 1 to n - 1, do the following: 

2.1 Let y := Zmax- 

2.2 Send yo via every port i for 1 < i < d. 

Set v, to the value received via port i for 1 < i < d. 

2.3 Let Zmax ■- max <,<d y t . 

3. Output z max . 



Figure 4: Subroutine C. 

respectively, since k is odd. The amplitude of state 111) 8 * is obviously 0. □ 

From the above two lemmas, the correctness of Subroutine B is immediate. 

Lemma 11 Suppose that k parties each have a qubit in one-qubit register R(> whose content forms a k-cat state 
together with the contents of the (k - 1) qubits of the other parties; further, suppose that they each prepare a 
fresh ancilla qubit initialized to |0) in another one-qubit register Ri. After running Subroutine B with Ro, Ri 
and k, the qubits in Rqs and Rqs form an inconsistent state over S, where S is the set of the indices of the k 
parties. 

The next lemma is obvious. 

Lemma 12 Subroutine B takes 0(1) time and needs no communication. 

3.4 Subroutine C 

Subroutine C is a classical algorithm that computes the maximum value over the values of all parties. It is very 
similar to Subroutine A. In fact, Subroutines A and C can be merged into one subroutine, although we will 
explain them separately for simplicity. Figure 4 gives a precise description of Subroutine C. 

Lemma 13 Suppose that each party I has integer zi and d[ neighbors in an n-party distributed system. If every 
party I runs Subroutine C with z :- Zi, n and d\- di as input, Subroutine C outputs the maximum value Zmax 
among all zis. 

Proof We will prove by induction the next claim: after repeating steps 2.1 to 2.3 t times, z max of party / is the 
maximum among zjs of all parties j who can be reached from party I via a path of length at most t. When 
t = 1, the claim obviously holds. Assume that the claim holds for t = m. After the next iteration of steps 2.1 to 
2-3, Zmax is updated to the maximum value among yo's of party / and his neighbors. Since yo is the z max of the 
previous iteration, the claim holds for t - m + 1 due to the assumption. Since any graph has diameter at most 
n - 1, Subroutine C outputs the maximum value z max among all z,s. □ 

In quite a similar way to the proof of Lemma 7, we have the next lemma. 
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Lemma 14 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Subroutine C takes 0(n) rounds and O(Dn) time. The total communication complexity over all parties is 
0(\E\n). 

3.5 Complexity analysis and generalization 

Now we prove Theorem 1. 

Theorem 1 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given a classical variable status initialized to "eligible" and the number n of parties, Algorithm I 
exactly elects a unique leader in 0(n 2 ) rounds and 0(Dn 2 ) time. Each party connected with d parties requires 
0(dn 2 )-qubit communication, and the total communication complexity over all parties is 0(\E\n 2 ). 

Proof Let S; be the set of the indices of parties with status = "eligible" (i.e., eligible parties) just before phase 
i. From Lemmas 6 and 11, we can see that, in each phase i, Algorithm I generates an inconsistent state over 5,-, 
if k - \Si\. Algorithm I then decreases the number of the eligible parties in step 2.5 by at least one, which is 
implied by Lemma 13. If A: is not equal to |5,-|, the number of the eligible parties is decreased or unchanged. We 
can thus prove that k is always at least in any phase i by induction, since k - \S i\ - n before entering phase 
1 and k is decreased by 1 in every phase. It is stressed that there is always at least one eligible party, since the 
eligible parties having z = Zmax at step 2.5 remain eligible. It follows that, after step 2, the number of eligible 
parties is exactly 1. This proves the correctness of Algorithm I. 

As for complexity, Subroutines A, B and C are dominant in step 2. Due to Lemmas 7, 12 and 14; 
the total communication complexity is 0(\E\n) x n = 0(\E\n 2 ) (each party with d neighbors incurs 0(dn 2 ) 
communication complexity); the time complexity is 0(Dn) x n = 0(Dn 2 ); the number of rounds required is 
0(n) Xn = 0(n 2 ). □ 



If each party knows only the upper bound N of the number of parties in advance, each party has only to 
perform Algorithm I with N instead of n. The correctness in this case is obvious from the proof of Theorem 1. 
The complexity is described simply by replacing every n by N in Theorem 1. 

Corollary 3 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given a classical variable status initialized to "eligible" and the number of parties, N, Algorithm I 
exactly elects a unique leader in 0(N 2 ) rounds and 0(DN 2 ) time. Each party connected with d parties incurs 
0(dN 2 )-qubit communication, and the total communication complexity over all parties is 0(\E\N 2 ). 

Furthermore, Algorithm I is easily modified so that it works well even in the asynchronous settings. Note 
that all parties receive messages via each port in each round. In the modified version, each party postpones 
performing the operations of the (i + l)st round until he finishes receiving all messages that are supposed to be 
received in the ith round. If all communication links work in the first-in-first-out manner, it is easy to recognize 
the messages sent in the ith round for any i. Otherwise, we tag every message, which increases the communica- 
tion and time complexity by the multiplicative factor 0(log n), in order to know in which round every received 
message was sent. This modification enables us to simulate synchronous behavior in asynchronous networks. 

4 Quantum leader election algorithm II 

Our second algorithm works well even on networks whose underlying graph is directed (and strongly- 
connected). Just for ease of understainding, we first describe the second algorithm on undirected networks, 
and then modify it in a fairly trivial way in Subsection 4.5 so that it works well on directed networks. 
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To work on networks whose underlying graph is directed, the second algorithm contains no inverting op- 
erations involving quantum processing: the second algorithm makes the most of a classical elegant technique, 
called view, to make quantum parts "one-way." As a by-product, the second algorithm requires less quantum 
communication than the first algorithm, although the total communication complexity increases. 

View was originally introduced by Yamashita and Kameda [48, 50] to characterize the topology of anony- 
mous networks on which the leader election problem can be solved deterministically. However, a naive ap- 
plication of view incurs exponential classical time/communication complexity. This paper introduces a new 
technique called folded view, which allows the algorithm to still run in time/communication polynomial with 
respect to the number of parties. 

4.1 View and folded view 

First, we briefly review the classical technique, view. Let G - (V, E) be the underlying network topology and 
let n - \V\. Suppose that each party corresponding to node v eV, or simply party v, has a value x v e U for a 
finite subset U of the set of integers, and a mapping X: V — > U is defined by X(v) = x v . We use the value given 
by X to identify the label of node in G. For each v and port numbering cr, view Tg >0 -,x(v) is a labeled, rooted tree 
with infinite depth defined recursively as follows: (1) Tg,o-,x(v) has root u with label X{v), corresponding to v, 
(2) for each vertex vj adjacent to v in G, Tg >0 -,x(v) has vertex Uj labeled with X(vj), and an edge from root u to 
Uj with label label((v, vy)), where label((v, v/)) = (or[v](v,Vj),cr[vj](y,Vj)), and (3) Uj is the root of Tc^xivf)- 
It should be stressed that v, vy, u, and uj are not identifiers of parties and are introduced just for definition. For 
simplicity, we often use 7x(v) instead of Tg,o-,x(v), because we usually discuss views of some fixed network 
with some fixed port numbering. The view of depth h with respect to v, denoted by T x (v), is the subtree of Tx(v) 
of depth h with the same root as Tx(v). 

If two views Tx(v) and Tx(v') for v,v' € V are isomorphic (including edge labels and node labels, but 
ignoring local names of vertices such as uf), their relation is denoted by Tx(v) = Tx{V). With this relation, V is 
divided into equivalence classes; v and V are in the same class if and only if Tx(v) = Tx(v'). In [48, 50], it was 
proved that all classes have the same cardinality for fixed G, cr and X; the cardinality is denoted by cg,o-,x, or 
simply cx (the maximum value of cg,o-,x over all port numbering cr is called symmetricity y{G, X) and used to 
give the necessary and sufficient condition to exactly solve LE„ in anonymous classical networks). We denote 
the set of non-isomorphic views by Tg^,x, i-e., ^G,a-,x = {Tg,o-,x(v) '■ v e V], and the set of non-isomorphic 
views of depth h by T^ x , i.e., T^ x - {T^ x (v) : v e V). For simplicity, we may use Fx and Y x instead of 
^G,a-,x and x , respectively. We can see that cx - n/\Tx\, since the number of views isomorphic to Tx £ Tx 
is constant over all Tx- For any subset S of U, let Tx(S) be the maximal subset of Yx such that any view 
Tx e Yx(S ) has its root labeled with a value in S . Thus the number cx(S ) of parties having values in S is 
cx\Tx(S)\ - n\Tx(S)\/\Tx\. When S is a singleton set {5}, we may use Tx(s) and cx(s) instead of T^Gs}) and 
cx({s}). 

To compute cx(S), every party v constructs T 2 x n \v), and then computes |Ix| and |Tx(5)|. To construct 
T x (v), in the first round, every party v constructs T x (v), i.e., the root of T x (v). If every party vj adjacent to v 
has T' x l (vj) in the ith round, v can construct T' x (v) in the (i + l)st round by exchanging a copy of T' x l (v) for a 
copy of T l ~ l {vj) for each j. By induction, in the (h + l)st round, each party v can construct T x (v). It is clear 
that, for each V e V, at least one node in T' x l {v) corresponds to V , since there is at least one path of length of 
at most (n- 1) between any pair of parties. Thus party v computes \Tx\ and |Tx(5)| by checking the equivalence 
of every pair of views that have their roots in T x ~ l (v). The view equivalence can be checked in finite steps, 
since T x (v) = T x (v') if and only if T^iv) = T x ~ l (V) for v, V e V [34]. This implies that \T X \ and |r x (5)| can 
be computed from T x ^ n ~ l \v). 

Note that the size of T x (v) is exponential in h, which results in exponential time/communication complexity 
in n when we construct it if h - 2(n - 1). To reduce the time/communication complexity to something bounded 
by a polynomial, we create the new technique called folded view by generalizing Ordered Binary Decision 
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Diagrams (OBDD) [15]. A folded view (f-view) of depth h is a vertex- and edge-labeled directed acyclic 
multigraph obtained by merging nodes at the same level in T^(v) into one node if the subtrees rooted at them 
are isomorphic. An f-view is said to be minimal and is denoted by T^(v) if it is obtained by maximally merging 
nodes of view T^(v) under the above condition. For simplicity, we may call a minimal f-view just an f-view 
in this section. The number of nodes in each level of an f-view is obviously bounded by n, and thus the total 
number of nodes in an f-view of depth h is at most hn. Actually, an f-view of depth h can be recursively 
constructed in a similar manner to view construction without unfolding intermediate f-views. Details will be 
described in Section 5. 

Theorem 15 If each party has a label of a constant-bit value, every f-view of depth h is constructed in 
0(D 2 h 2 n(log n) 2 ) time for each party and 0(h) rounds with 0(D\E\h 2 n log D) bits of classical communication. 

is constructed, each party can compute \Y\\ and \Tx(S )| without communication in 0(Dn 5 log n) 
time, where S is any subset of range U ofX, and \E\ and D are the number of edges and the maximum degree, 
respectively, of the underlying graph. 

Remark Kranakis and Krizanc [30] gave two algorithms that compute a Boolean function for distributed inputs 
on anonymous networks. In their first algorithm, every party essentially constructs a view of depth 0(n) in 0(n 2 ) 
rounds and the total communication complexity over all parties of 0(n 6 log ri), followed by local computation 
(their model assumes that every party knows the topology of the network and thus the number of parties, but 
their first algorithm can work even when every party knows only the number of parties). Thus, our folded 
view quadratically reduces the number of rounds required to compute a Boolean function, with the same total 
communication complexity. Note that their second algorithm can compute a symmetric Boolean function with 
lower communication complexity, i.e., 0(n 5 (logn) 2 ), and 0(n 3 log n) rounds, but it requires that every party 
knows the topology of network. 

4.2 The algorithm 

As in the previous section, we assume that the network is synchronous and each party knows the number n of 
parties prior to algorithm invocation. Again our algorithm is easily generalized to the asynchronous case. It is 
also possible to modify our algorithm so that it works well even if only the upper bound N of the number of 
parties is given, which will be discussed in Subsection 4.4. 

The algorithm consists of two stages, which we call Stages 1 and 2 hereafter. Stage 1 aims to have the 
n parties share a certain type of entanglement, and thus, this stage requires the parties to exchange quantum 
messages. In Stage 1, each party performs Subroutine Q s = Tlog«] times in parallel to share s pure quantum 
states . . . , |0 (v) ) of n qubits. Here, each is of the form + \jc 1 '))/ V2 for an n-bit string x w and 
its bitwise negation x w , and the Ith qubit of each |0 (,) > is possessed by the Zth party. It is stressed that only one 
round of quantum communication is necessary in Stage 1. 

In Stage 2, the algorithm decides a unique leader among the n parties by just local quantum operations and 
classical communications with the help of the shared entanglement prepared in Stage 1 . This stage consists of at 
most s phases, each of which reduces the number of eligible parties by at least half. Let 5, c {1, ...,«} be the set 
of all Is such that party I is still eligible just before entering phase i. First every party runs Subroutine A to decide 
if state \(p^) is consistent or inconsistent over Si. Here the consistent/inconsistent strings/states are defined in 
the same manner as in the previous section. If state is consistent, every party performs Subroutine B, 
which first transforms |0 (,) > into the |S,-|-cat state (|0} (g ' 15 '' 1 + II}® 15 '' 1 )/ V2 shared only by eligible parties and then 
calls Subroutine B described in the previous section to obtain an inconsistent state over 5,-. Each party / then 
measures his qubits to obtain a label and performs Subroutine C. to find the minority among all labels. The 
number of eligible parties is then reduced by at least half via minority voting with respect to the labels. 

More precisely, each party / having di adjacent parties performs Algorithm II described in Figure 5 with 
parameters "eligible," n, and du The party who obtains output "eligible" is the unique leader. 
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Algorithm II 

Input: a classical variable status e {"eligible", "ineligible"}, integers n, d 
Output: a classical variable status € {"eligible", "ineligible") 

Stage 1: 

Let s := |~log n\ and prepare one-qubit quantum registers Rq , . . . , R ' s) and Rj , . . . , Rj , each of which 
is initialized to the |0> state. 

Perform s attempts of Subroutine Q in parallel, each with R^ and d for 1 < i < s, to obtain d-b\t string 
y® and to share |0®> = (|x® > + |x (0 »/ V2 of n qubits. 
Stage 2: 

Let k := n. 

For i := 1 to s, repeat the following: 

1. Perform Subroutine A with status, n, d, and y® to obtain its output consistency. 

2. If consistency = "consistent," perform Subroutine B with R* , Rj , status, k, n, and d. 

3. If status = "eligible," measure the qubits in Rg and R^ in the {|0>, |1>) basis to obtain a nonnegative 
integer z (0 < z < 3); otherwise set z := -1. 

Perform Subroutine C with status, z, n, and d to compute nonnegative integers z m i nor and c Zminor . 

4. If z + Zminor, let status := "ineligible." 

5. If k = 1, terminate and output status. 



Figure 5: Quantum leader election algorithm II. 

4.2.1 Subroutine Q: 

Subroutine Q is mainly for the purpose of sharing a cat-like quantum state \<f>) - (\x) + V2 for an «-bit 
random string x. It also outputs a classical string, which is used in Stage 2 for each party to obtain the infor- 
mation on \(p) via just classical communication. This subroutine can be performed in parallel, and thus Stage 
1 involves only one round of quantum communication. First each party prepares the state (|0> + |1»/ V2 in a 
quantum register and computes the XOR of the contents of his own and each adjacent party's registers. The 
party then measures the qubits whose contents are the results of the XORs. This results in the state of the form 
(|x) + V2. Figure 6 gives a precise description of Subroutine Q. 
The next two lemmas are for correctness and complexity. 

Lemma 16 For an n-party distributed system, suppose that every party I calls Subroutine Q with a one-qubit 
register whose content is initialized to |0) and the number d[ of his neighbors as input Ro and d, respectively. 
After performing Subroutine Q, all parties share (|x) + V2 with certainty, where x is a randomly chosen 
n-bit string. 

Proof After step 2 of Subroutine Q, the system state, i.e., the state in Ro's, R' ; 's, . . . , R^'s and Si 's, . . . , S/s 
of all parties, is the tensor product of the states of all parties as described by formula (1). Notice that the state 
in Ro's and Rj's, . . . ,R^'s of all parties is the uniform superposition of some basis states in an orthonormal 
basis of 2^"=i (rf/+1) -dimensional Hilbert space: the basis states correspond one-to-one to n-bit integers a and 
each of them has the form \a\)®( d[+1) ® • • • ® \a n )^ d " +l \ where ai is the Zth bit of the binary expression of a 
and ai is the content of Ro of party I. If we focus on the Zth party's part of the basis state corresponding to a, 
step 3 transforms \ai)® ( - dl+l) to \af) k*/,-))> where party I is connected to party lj via port j. More precisely, 

step 3 transforms the system state into the state as described in formula (2). After step 4, we have the state of 
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Subroutine Q 
Input: a one-qubit quantum register Ro, an integer d 
Output: a one-qubit quantum register Ro, a binary string y of length d 

1. Prepare 2d one-qubit quantum registers Rj, . . . ,R^ and Si, . . . , Sd, each of which is initialized to the |0> 
state. 

2. Generate the (d + l)-cat state (|0> 8(rf+1) + |1>^ +1 ))/ V2 in registers R , R;, . . . , R^. 

3. Exchange the qubit in R^ with the party connected via port i for 1 < i < d (i.e., the original qubit in R^ is 
sent via port i, and the qubit received via that port is newly set in R'). 

4. Set the content of S, to xo © x,, for 1 < i < d, where xq and x, denote the contents of Ro and R^, respec- 
tively. 

5. Measure the qubit in S, in the {|0>, |1>} basis to obtain bit yi, for 1 < i < d. 
Sety := y x ■■■y d . 

6. Apply CNOT controlled by the content of Ro and targeted to the content of each R^ for i - 1, 2, . . . , d to 
disentangle R^s. 

7. Output Ro and y. 

Figure 6: Subroutine Q. 
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formula (3). Next every party / measures the last d\ registers S,'s at step 5. 
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Claim 17 Suppose that every party I has obtained measurement results y(l) = y\{t)yi{l) • • • yd,Q) of di hits where 
yj(l) € {0, 1}. There are exactly two binary strings a = a\a2 ■ ■ ■ a n that satisfy equations ai © a/ ; . = yj(l)(l = 
1, . . . ,n, j - 1, . . . , di). If the binary strings are A and A, then A is the bit-wise negation of A. 

Proof We call binary strings a "solutions" of the equations. By definition, there is at least one solution. If A is 
such a string, obviously its bit-wise negation A is also a solution by the fact that a ; ©a 7 - = ojffiojfor 1 < i,j < n. 
We will prove that there is the unique solution such that a\ = 0. It follows that there is the unique solution such 
that a\ = 1 since the bitwise negation of a solution is also a solution. This completes the proof. 

Let [Vq,Vi, . . . ,V P ) be the partition of the set V of the indices of parties such that Vo = {1} and V, = 
Adj(lJmio \ Umio Vm> where p is the maximum length of the shortest path from party 1 to party / over all I, 
and Adj(V) for a set V c V is the set of neighbors of the parties in V. 

Equations a/ © a/. = yj(l) are equivalent to a;. = yj(l) © a/ (/ = 1, j = I,..., di). Assume that a\ = 0. 
For all / in V\, ai is uniquely determined by the equations. Similarly, if a/ is fixed for all / in U^io ^»i> a l ^ s 
uniquely determined for all I in V,. Since the underlying graph of the distributed system is connected, a/ is 
uniquely determined for all I. □ 
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From the above claim, we get the superposition of two basis states corresponding to A and its bit-wise 
negation A after step 5 as described by formula (4), where A/ is the Zth bit of A. Step 6 transforms the state into 
that represented by formula (5), in which registers R^'s of all parties are disentangled because of \Ai © A/ ; .) = 
\A~i © A/~). Thus, R 's is in the state of (|jc) + pc»/ V2. 
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Lemma 18 Le? |£| a«<i D fee fJie number of edges and the maximum degree, respectively, of the underlying 
graph of an n-party distributed system. Subroutine Q takes 0(D) time for each party, and incurs one round 
with 2\E\-qubit communication. 

Proof Each party Z performs just one-round communication of di qubits. The local computations can be done 
in time linear in di. □ 



4.2.2 Subroutine A: 

Suppose that, after Subroutine Q, «-qubit state \<f>) = (\x) + \x))/ V2 is shared by the n parties such that the Zth 
party has the Zth qubit. Let x\ be the Zth bit of x, and let X and X be mappings defined by X(v) - xi and X(v) - ~i 
for each Z, respectively, where v e V represents the node corresponding to the Zth party in the underlying graph 
G = (V,E) of the network topology. For any v in V, let W[v] : V -> {0, 1} x {"eligible", "ineligible"} be the 
mapping defined as (7[v], Z), where Y[v] is X if X(v) = and X otherwise, and Z : V -> {"eligible", "ineligible") 
maps v e V to the value of status possessed by the party corresponding to v. We denote (F[v],Z) by W[v], 
where Fjv] - X if Y[v] = X and Y[v] = X otherwise. 

Subroutine A checks the consistency of \(p), but in quite a different way from Subroutine A. Every party 
Z constructs the folded view r^"A(v) by using the output y of Subroutine Q. The folded view is constructed 
by the f-view construction algorithm in Figure 14 in subsection 5.4 with slight modification; the modification 
is required since mapping W[v] is not necessarily common over all parties v. The construction still involves 
only classical communication. By checking if the nodes for eligible parties in the folded view have the same 
labels, Subroutine A can decide whether \<p) is consistent or not over the set of the indices of eligible parties. 
Figure 7 gives a precise description of Subroutine A. The next lemmas present the correctness and complexity 
of Subroutine A. 

Lemma 19 Suppose that the n parties share n-qubit cat-like state (|x) + |x))/V2, where x is n-bit string 
X(v\)X(v2) • ■ ■ X(v n ) for Vi € V and x is the bitwise negation of x. Let S be the set of the indices of the 
parties among the n parties whose variable status is "eligible," and let v e V be the corresponding node of 
party I. If every party I runs Subroutine A with the following objects as input: 

• a classical variable status e {"eligible", "ineligible"), 

• n and the number di of the neighbors of party I, 
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Subroutine A 

Input: a classical variable status e {"eligible", "ineligible"}, integers n, d, a binary string y of length d 
Output: a classical variable consistency e {consistent, inconsistent) 

1. Set f^ [v] (v) to a node labeled with (0, status), where W[v] : V -> {0, 1} x {"eligible", "ineligible"} be the 
mapping defined as (Y[v],Z), Y[v] is X if X(v) - and X otherwise, and Z is the underlying mapping 
naturally induced by the values of status. 

2. For i :- 1 to (n — 1), do the following: 

2.1 Send r^-j(v) and receive T'^ v j(v 7 ) via port j, for 1 < j < d, where node vj corresponds to the 
party connected via port j. 

2.2 If the j'th bit yj of y is 1, transform T'^ v ^(yj) into rizl_(vy) by negating the first element of every 

node label for 1 < j < d, where W[vj] represents (Y[vj],Z). 

2.3 Set the root of T' ,(v) to the node labeled with (0, status). 

Set the fth child of the root of f' ,(y) to ftl (v.), for 1 < / < d such that y, = 1. 

■> W[v] v > W[Vi] 3 — J — J ] 

Set the jth child of the root of T' w ^(y) to T'^ v ^(vj), for 1 < j < d such that yj = 0. 

For every level of T' WM (v), merge nodes at that level into one node if the views rooted at them are 
isomorphic. 

3. If both label (0, "eligible") and label (1, "eligible") are found among the node labels in r^fv), let 
consistency := "inconsistent"; otherwise let consistency := "consistent." 

4. Output consistency. 



Figure 7: Subroutine A. 

• a binary string y = y\ ■ ■ ■ y^, of length di such that yj = X(v) © X(vj)for j = 1, . . . , d\ where vj is the jth 
adjacent node ofv, 

Subroutine A outputs classical valuable consistency, which has value "consistent" if(\x) + |x))/ V2 is consis- 
tent over S, and "inconsistent" otherwise. 

Proof It will be proved later that steps 1 and 2 construct an f-view of depth (n - 1) for mapping either (X, Z) or 
(X,Z). Since the f-view is made by merging those nodes at the same depth which are the roots of isomorphic 
views, the f-view contains at least one node that has the same label as (X(v), Z(v)) or (X(v), Z(v)) for any v e V. 
Once the f-view is constructed, every party can know whether X is constant over all Z € 5 or not in step 3 by 
checking the labels including "eligible." Notice that no party needs to know for which mapping of (X,Z) or 
(X, Z) it has constructed the f-view. 

In what follows, we prove that steps 1 and 2 construct an f-view for mapping either X or X. The proof 
is by induction on depth i of the f-view. Clearly, step 1 generates rj^ [v] (v). Assume that every party Z' has 

constructed ^^(v') where node V represents party V . In order to construct T l WM (v), party Z needs T l w ^(vj) 

for every node vy adjacent to v. Although W[v] is not always identical to W[vy], we can transform T'^ ^Vj) 

to r^fvy). Since yj is equal to X(v) © X(vj) = X(v) © X(vj), each of X and X gives the same value for v 
and vj if and only if yj - 0. This fact, together with F[v](v) = Y[vj](vj) - 0, implies that Y[v] is identical 
to Y[vj] if and only if yj - 0. It follows that, if yj - 0, T'^ v ^(vj) is isomorphic to T^^Vj), and otherwise 

T!—}—(vj) is isomorphic to T' w }Jvj). In the latter case, the party corresponding to v negates the first elements of 
all node labels in T'^ v ^(vj) to obtain T'~ l (vj). Thus step 3 can construct T' w ^(v). This completes the proof. □ 
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Subroutine B 

Input: one-qubit quantum registers Ro,Ri, a classical variable status e {"eligible", "ineligible"}, integers 
k, n, d 

Output: one-qubit quantum registers Ro, Ri 

1. Let w := 0. 

2. If status = "ineligible," measure the qubit in R in the {|+>, |->} basis. 
If this results in |— ), let w := 1. 

3. Construct f-view T^ n ~ l \v) to count the number p of parties with w - 1, where W is the underlying 
mapping naturally induced by the w values of all parties. 

4. If p is odd and status = "eligible," apply Wt to the qubit in R . 

5. If status = "eligible," perform Subroutine B with R , Ri and k. 

6. Output quantum registers Rq and Ri . 



Figure 8: Subroutine B. 



Lemma 20 Let \E\ and D be the number of edges and the maximum degree, respectively, of the underlying 
graph of an n-party distributed system. Subroutine A takes 0(D 2 n 3 (log n) ) time for each party, and incurs 
0(n) rounds with classical communication of 0(D\E\n 3 log D) bits. 

Proof Steps 1 and 2 are basically the f-view construction algorithm in Figure 14 in subsection 5.4 except step 
2.2; this step takes 0(Dn 2 ) time since an f-view of depth 0(n) has 0(Dn 2 ) edges. Thus, steps 1 and 2 take 
0(D 2 n 3 (log n) 2 ) time for each party, incur 0(ri) rounds and exchange 0(D\E\n 3 log D) bits by Theorem 15. 
Step 3 takes 0(Dn 2 ) time. □ 



4.2.3 Subroutine B: 

Suppose that \(f>) = (\x) + \x))/ V2 shared by the n parties is consistent over the set S of the indices of eligible 
parties. Subroutine B has the goal of transforming \<j>) into an inconsistent state over S . Let k be \S |. First every 
ineligible party measures its qubit in the ||+>, |-)} basis, where |+> and |-> denote (|0> + |1»/ V2 and (|0) - 
|1))/ V2, respectively. As a result, the state shared by the eligible parties becomes either ±(\0)® k + II) 8 *)/ V2 or 
±(|0> 8 * - II) 8 *)/ V2. The state ±(|0>®* - \l)® k )/ V2 is shared if and only if the number of ineligible parties that 
measured |-) is odd, as will be proved in Lemma 23. In this case, every eligible party applies unitary operator 
Wk to its qubit so that the shared state is transformed into ±(|0) 8 * + II) 8 *)/ V2, where the family {Wk\ of unitary 
operators is defined by 



Again let v denote the node corresponding to the party that invokes the subroutine. Figure 8 gives a precise 
description of Subroutine B. The correctness and complexity of the subroutine will be described in Lem- 
mas 21 and 22, respectively. 

Lemma 21 Suppose that the n parties share n-qubit cat-like state \<p) - (\x) + pc))/ V2, where x is any n-bit 
string that is consistent over S, and x is the bitwise negation of x. If each party I runs Subroutine B with the 
following objects as input: 
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• one-qubit register Ro, which stores one of the n qubits in state \(f>), 

• one-qubit register Ri, which is initialized to |0), 

• a classical variable status, the value of which is "eligible" if I is in S and "ineligible" otherwise, 

• integers k, n, and the number d[ of neighbors of party I, 

Subroutine B outputs two one-qubit registers Ro, Ri such that, if given k is equal to \S \, the qubits in the registers 
satisfy the conditions: 

• the 2k qubits possessed by all parties I' for I' e S are in an inconsistent state over S, 

• the 2(n-k) qubits possessed by all parties I' for I' £ S are in a classical state (as a result of measurement). 

Proof Lemma 23 guarantees that, after step 2, the eligible parties (i.e., the parties who have status = "eligible") 
share flO) 8 * + II) 8 *)/ V2 ((|0>®* - \lf k )/ V2) if the number of those parties who have measured |-> is even 
(respectively, odd). When the eligible parties share flO) 8 * - II} 8 *)/ V2, step 4 transforms the shared state into 
(I0) 8 * + II} 8 *)/ V2. Due to Lemma 11, the eligible parties share an inconsistent state over S after step 5. This 
completes the proof. □ 



Lemma 22 Let \E\ and D be the number of edges of the underlying graph of an n-party distributed system. 
Subroutine B takes 0(Dn 5 log n) time for each party, takes 0(n) rounds and requires 0(D\E\n 3 log D)-bit com- 
munication. 

Proof Since Subroutine B takes 0(1) time and does no communication, step 3 is dominant. The proof is 
completed by Theorem 15. □ 



Lemma 23 Let S be an arbitrary subset of [1,2, . . .n] parties such that \S\ — k. Suppose that n parties share 
n-qubit cat-like state (\x) + \x))/ V2, where x is any n-bit string that is consistent over S, and x is the bitwise 
negation of x. If every party I for I S measures his qubit with respect to the Hadamard basis {|+), |— )}, the 
resulting state is flO) 8 * + \l) 0k )/ V2 f(|0>®* - II) 8 *)/ V2) when the number of those parties is even ( respectively, 
odd) who have measured |— ). 

Proof From the next two claims (a) and (b), and the induction on the number of parties, the lemma follows. 

(a) If m parties share m-qubit state (\zi . - - z m ) + \zi ■ ■ ■ z m ))l V2 for any Zi e {0, 1} (i - 1, . . . , m) (z,- is the 
negation of zi) and the last party measures his qubit with respect to the Hadamard basis, then the resulting 
state is (\zi ...z m -\) + |zi . . .z m -i»/ V2 ((|zi ...z m -\) ~ Izi • • -Zm-i»/ V2) when he measured |+> (|-». 

(b) If m parties share m-qubit state (|zi . . . z m ) - |zi . . . 1m)) I V2 for any Zi e {0, 1} (i - 1, . . . , m), and the last 
party measures his qubit with respect to the Hadamard basis, then the resulting state is (\zi ■ ■ .z m -i) ~ 
\zi . ..z m -\))l V2 ((|zi . ..Zm-\) + \z\.. -Z m -\))l V2) up to global phases when he measured |+> (|-». 

We first prove claim (a). By simple calculation, we have 



|Zl . ..Z m ) + \Z\ ■ ..Z m ) \Z\ . . . Zm-l) + \Z\ ■ ■ -Zm-l) 



l + > + 




|->- 




Thus, claim (a) follows. 
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Subroutine C 

Input: integers z e {-1,0, 1,2,3}, n, d 
Output: integers z minor , c Zmmm 

1. Construct f-view T z n ~ (v), where Z is the underlying mapping naturally induced by the z values of all 
parties. 

2. For i := to 3, count the number, q, of parties having a value z - i using T^ n ~ l \v). 
If Ci = 0, let c, := ra. 

3. Let z minor e{m\c m = min <,< 3 q}. 

4. Output Zminor and c w . 



Figure 9: Subroutine C 
Similarly, claim (b) is proved by the next equation: 

kl • • -Zm) ~ \Zl ■ ■ .Z m ) \Zl . . . Zm-l) ~ \Zl . . .Z m -l) z \Z\ ■ ■ ■ Z m -\ > + \Z\ . . . Z m -l) . > 
p - p 1 + > + (-l) Zm p 1->- 

V2 V2 V2 

□ 



4.2.4 Subroutine C: 

Suppose that each party / has value zi- Subroutine C is a classical algorithm that computes value z m i nor such that 
the number of parties with value z m i nor is non-zero and the smallest among all possible non-negative z\ values. It 
is stressed that the number of parties with value z m i nor is at most half the number of parties having non-negative 
Zi values, and that the parties having non-negative zi values are eligible from the construction of Algorithm II. 
Figure 9 gives a precise description of Subroutine C. 

The next two lemmas give the correctness and complexity of Subroutine C. 

Lemma 24 Suppose that each party I among n parties has an integer zi e {-1, 0, 1, 2, 3}. If every party I runs 
Subroutine Cwithzi, n and the number d[ of neighbors as input, Subroutine C outputs Zoodot £ [zi, ■ ■ ■ ,Zn)\{ - l), 
and c Zminor such that the number c Zmmo[ of parties having z m i n0 r is not more than that of parties having any other 
Zi (ties are broken arbitrarily). 

Proof The first line of step 2 in Figure 9 counts the number q of parties having i as z for each i e {0, 1, 2, 3} by 
using f-view. Since c; = implies z m i n0 r + i, c, is set to n so that i cannot be selected as z m i n0 r in step 3. Thus, 
Zminor is selected among {zi , . . . , z n } \ {- 1 }• □ 



Lemma 25 Let \E\ and D be the number of edges and the maximum degree of the underlying graph of an n- 
party distributed system. Subroutine C takes 0(Dn 5 log n) time for each party, takes 0(n) rounds, and requires 
0(D\E\n 3 log D)-bit communication. 

Proof Steps 1 and 2 are dominant. The proof is completed by Theorem 15. □ 
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4.3 Complexity analysis 



Now we prove Theorem 2. 

Theorem 2 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given the number n of parties, Algorithm II exactly elects a unique leader in 0(Dn 5 (log n) 2 ) time and 
0(n log n) rounds of which only the first round requires quantum communication. The total communication 
complexity over all parties is 0(D\E\n 3 (\og D) log n) which includes the communication of only 0(\E\\ogri) 
qubits. 

Proof Lemma 16 guarantees that Stage 1 works correctly. We will prove that steps 1 to 5 of Stage 2 decrease 
the number of eligible parties by at least half, without eliminating all eligible parties, if there are at least two 
eligible parties. This directly leads to the correctness of Algorithm II, since s := flog n]. 

The proof is by induction on phase number i. At the beginning of the first phase, k obviously represents the 
number of eligible parties. Next we prove that if k is equal to the number of eligible parties immediately before 
entering phase i, steps 1 to 5 decrease the number of eligible parties by at least half without eliminating all such 
parties, and set k to the updated number of the eligible parties. By Lemmas 19 and 21 and the assumption that 
k is the number of eligible parties, only eligible parties share an inconsistent state with certainty after steps 1 
and 2. Thus, it is impossible that all eligible parties get the same value by measurement at step 3. Subroutine C 
correctly computes z m i n0 r and the number c Zmmor as proved in Lemma 24. Hence, step 4 reduces eligible parties 
by at least half with certainty and sets k to the updated number of the eligible parties. 

Next, we analyze the complexity of Algorithm II. By Lemma 18, Stage 1 takes 0(D) time for each party 
and one round, and requires 0(\E\ log «)-qubit communication. Stage 2 iterates Subroutines A, B and C at most 
0(log n) times. By Lemmas 20, 22 and 25, Subroutines A, B and C take 0(n) rounds, 0(Dn 5 log ri) time and 
require 0(D\E\n 3 log D) classical bit communication for each iteration. Hence, Stage 2 takes 0(n log ri) rounds 
and 0(Dn 5 (log ri) 2 ) time, and requires 0(D\E\n 3 (log D) log n) classical bit communication. This completes the 
proof. □ 



4.4 Generalization of the algorithm 

In the case where only the upper bound N of the number of parties is given, we cannot apply Algorithm II as 
it is, since Algorithm II strongly depends on counting the exact number of eligible parties and this requires the 
exact number of parties. 

We modify Algorithm II so that it outputs status = "error" and halts (1) if steps 1 to 5 of Stage 2 are iterated 
over log n times, or (2) if it is found that non-integer values are being stored into the variables whose values 
should be integers. Notice that we can easily see that this modified Algorithm II can run (though it may halt 
with output "error") even when it is given the wrong number of parties as input, unless the above condition (2) 
becomes true during execution. Let the modified Algorithm II be LE(status, n, d). 

The basic idea is to run LE("eligible", m,d) (2 < m < N) in parallel. Here we assume that every party 
has one processor, and all local computations are performed sequentially. Message passing, on the other hand, 
is done in parallel, i.e., at each round the messages of LE("eligible", m, d) (2 < m < N) are packed into one 
message and sent to adjacent parties. Although this parallelism cannot reduce time/communication complexity, 
it can reduce the number of rounds needed. Let M be the largest m e {2,3, . . . ,N} such that LE("eligible", m, d) 
terminates with output "eligible" or "ineligible." The next lemma implies that M is equal to the hidden number 
of parties, i.e., n, and thus LE("eligible", M, d) elects the unique leader. Figure 10 describes this generalized 
algorithm. We call it the Generalized Algorithm II. 

Lemma 26 For any number m larger than the number n of parties, if every party I runs LE( "eligible ",m, di), 
it always outputs "error," where di is the number of neighbors of party I. 
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Generalized Algorithm II 
Input: a classical variable status e {"eligible", "ineligible"), integers N, d 
Output: a classical variable status € {"eligible", "ineligible") 

1. Run in parallel LE("eligible", m, d) for m = 2, 3, ... , N. 

2. Output status returned by LE("eligible", M, d), where M is the largest value of m e {2, 3, . . . ,N] such 
that LE("eligible",m,<i) outputs status e {"eligible", "ineligible"). 

Figure 10: Generalized Algorithm II. 

Proof It is sufficient to prove that k is never equal to 1 in the modified Algorithm II, since step 5 of Stage 
2 outputs status only when k - 1 . k is set to c Zmmor at step 4 of Stage 2 and c Zmmm is computed at step 3 of 
Subroutine C. We prove that, for any i, c, > 1 at step 2 of Subroutine C, from which the lemma follows. 
Subroutine C computes 

|r20»-i)(,-)| 

Ci ~ m | r 2(m-l)| • 

If i is in {0, 1,2, 3) \ {zi, . . . ,z n ) where zi is the z value of party /, c, is set to n\ otherwise 

Ci > m/n > 1, 

since \T 2(m - r \i)\ > 1 and \T^- l )\ < n. □ 



Now we prove a corollary of Theorem 2. 

Corollary 4 Let \E\ and D be the number of edges and the maximum degree of the underlying graph, respec- 
tively. Given the upper bound N of the number of parties, the Generalized Algorithm II exactly elects a unique 
leader in 0(DN 6 (logN) 2 ) time and 0(N log N) rounds of which only the first round requires quantum commu- 
nication. The total communication complexity over all parties is C?(D|£'|A^ 4 (log D) log N) which includes the 
communication of only 0(\E\N log N) qubits. 

Proof From Lemma 26, the correctness is obvious. As for the complexity, we can obtain the complexity 
of the modified Algorithm II, i.e., LE("eligible", m, d), simply by replacing n with m in the complexity of 
the (original) Algorithm II. Since the Generalized Algorithm II runs LE("eligible", m, d) for m = 2, ... ,N in 
parallel, the number of rounds required is the same as the maximum of that of the modified Algorithm II over 
m = 2,...N. The time/communication complexity is 0(Zm=2 ^( m )) = 0{N • C{N)), where C(m) is that of 
Algorithm II stated in Theorem 2 for an m-party case. □ 



In fact, it is possible to reduce the time/communication complexity at the expense of the number of rounds. 
Suppose that every party / runs LE("eligible", m, d{) sequentially in decreasing order of m starting at N. When 
LE("eligible", m, di) outputs status that is either "eligible" or "ineligible," the algorithm halts. From Lemma 26, 
it is clear that the algorithm halts when m - n, which saves the time and communication that would be otherwise 
required by LE("eligible", m, di) for m <n. 

4.5 Modification for directed network topologies 

Algorithm II can be easily modified so that it can be applied to the network topologies whose underlying graph 
is directed and strongly-connected. 
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We slightly modify the network model as follows. In a quantum distributed system, every party can perform 
quantum computation and communication, and each pair of parties has at most one uni-directional quantum 
communication link in each direction between them. For each pair of parties, there is at least one directed path 
between them for each direction. When the parties and links are regarded as nodes and edges, respectively, the 
topology of the distributed system is expressed by a strongly-connected graph, denoted by G = (V, E). Every 
party has two kinds of ports: in-ports and out-ports; they correspond one-to-one to incoming and outgoing 
communication links, respectively, incident to the party. Every port of party I has a unique label i, (1 < i < di), 
where di is the number of parties adjacent to / and di = d\ + d° for the number d\ (d°) of in-ports (resp. 
out-ports) of party /. For G = (V, E), the port numbering cr is defined in the same way as in the case of 
the undirected graph model. Just for ease of explanation, we assume that in-port i of party / corresponds to 
the incoming communication link connected to the ith party among all adjacent parties that have an outgoing 
communication link destined to party I; out-port i of party / is also interpreted in a similar way. 

The view for the strongly-connected underlying graph can be naturally defined. For each v and port num- 
bering cr, view Tg,o-,x(v) is a labeled, rooted tree with infinite depth defined recursively as follows: (1) Tg,o-,x(v) 
has the root w with label X(v), corresponding to v, (2) for the source vj of every directed edge coming to v in 
G, Tq ^x(v) has vertex wj labeled with X(vj), and an edge from root w to wj with label label((v, vy)) given by 
label((v, vj)) - (cr[v](v, vf), cr[v/](v, vj)), and (3) wj is the root of Tc^xivf)- T^(v) is defined in the same way 
as in the case of the undirected graph model. The above definition also gives a way of constructing T G(rX (v). 
It is stressed that every party corresponds to at least one node of the view if the underlying graph is strongly- 
connected. It can be proved in almost the same way as [48, 50] that the equivalence classes with respect to the 
isomorphism of views have the same cardinality for fixed G - (V, E), cr and X; cg,o-,x(S) can be computed from 
a view. 

Lemma 27 For the distributed system whose underlying graph G = (V, E) is strongly-connected, the number 
of views isomorphic to view T is constant over all T for fixed cr and X. 

Proof Let T(v) and T(V) be any two non-isomorphic views for fixed cr and X, and let [T(v\), . . . , T(v m )} be 
the set of all views isomorphic to T(v), where v e {v ; - | i - 1, . . . ,m} c V. Since the underlying graph is 
strongly-connected, there is a subtree of T(v\) which is isomorphic to T(v'). Let s be the sequence of edge 
and node labels from the root of T(v\) to the root u\ of the subtree. Since all views in {T(vi), . . . , T(v m )} 
are isomorphic to one another, there is a node w, that can be reached from the root of 7\v,) along s for each 
i - 1, ... in. Clearly, every w,- is the root of a tree isomorphic to T(v'). Since v,- and vy correspond to different 
parties if i + j, ui and Uj also correspond to different parties if i ± j. This implies that the number of views 
isomorphic to T(v') is not less than that of views isomorphic to T(v). By replacing T(v) with T(v'), we can see 
that the number of views isomorphic to T(v) is not less than that of views isomorphic to T(v'). This completes 
the proof. □ 

Since f-view is essentially a technique for compressing a tree structure by sharing isomorphic subtrees, 
f-view also works for views of any strongly-connected underlying graph. 

From the above, it is not difficult to see that Subroutines A, B and C work well (with only slight mod- 
ification), since they use only classical communication. In what follows, we describe a modification, called 
Subroutine Q', to Subroutine Q. With the subroutine, the correctness of the modification to Algorithm II will 
be obvious for any strongly-connected underlying graph. 

Subroutine Q' simply restricts Subroutine Q so that every party can send qubits only via out-ports and 
receive qubits only via in-ports. Figure 11 gives a precise description of Subroutine Q'; the subroutine re- 
quires two integers d 1 and d° together with Ro as input, which are taken to be d\ and df, respectively. Thus, 
Algorithm II needs to be slightly modified so that it can handle d 1 and d° instead of d. 

We can prove the next lemma in a similar way to Lemma 16. 
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Subroutine Q' 



Input: a one-qubit quantum register Ro, integers d 1 and d° 

Output: a one-qubit quantum register Ro, a binary string y of length d 1 

1. Prepare d° one-qubit quantum registers Rj, . . . , R' d0 and 2d 1 one-qubit quantum registers R", . . . , R^, 
Si, . . . , S d i, each of which is initialized to the |0> state. 

2. Generate the (d° + l)-cat state (|0> 8(£, " +1) + |l>^ 0+1 ))/ V2 in registers R , R[, . . . , R' d0 . 

3. Send the qubit in R^ to the party connected via out-port i for 1 < i < d°. 

Receive the qubit from the party connected via in-port i and store it in one-qubit register R" for 1 < i < d 1 . 

4. Set the content of S, to xq © xu for 1 < i < d l , where xq and x, denote the contents of Ro and R", respec- 
tively. 

5. Measure the qubit in S ; - in the ||0>, |1>} basis to obtain bit y,-, for 1 < i < d 1 . 
Sety :=yi---y#. 

6. Apply CNOT controlled by the content of Ro and targeted to the content of each R" for i - 1, 2, . . . , d 1 
to disentagle R"s. 

7. Output Ro andy. 



Figure 11: Subroutine Q' 



Lemma 28 For an n-party distributed system, suppose that every party I calls Subroutine Q ' with a one-qubit 
register whose content is initialized to |0) and d\ and d° as input Ro, d 1 and d°, respectively. After performing 
Subroutine Q', all parties share (|x) + |x))/ V2 with certainty, where x is a random n-bit string. 

Proof (Sketch). After step 2, the state in Ro's and R'^'s, . . . , R^'/ s of all parties is a uniform superposition of 

some basis states in an orthonormal basis of 2^'=i (£/ '° +1) -dimensional Hilbert space: the basis states correspond 
one-to-one to «-bit integers a and each of the basis states is of the form \a{)^ d i ® • • • ® \a n )®( d " where a/ 
is the Zth bit of the binary expression of a. If we focus on the Zth party's part of the basis state corresponding to 

a, step 3 transforms |a;) ^ O+1 ^ into \a{) l a /, )j> where we assume that party / is connected to party lj via 

in-port j. Notice that the total number of qubits over all parties is preserved, since Ji" =1 d\ - H" =1 df. More 
precisely, steps 1 to 4 transform the system state as follows: 
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After every party measures registers S,'s at step 5, the state transformation can be described as follows, due to 
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a similar argument to Claim 17 (using the strong connectivity of the underlying graph): 
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Finally, the qubits in Rq's are in the state (|x> + |x»/ V2. 



It is easy to see that the complexity has the same order as that in the case of undirected networks: Theorem 2 
and Corollary 4 hold, if we define D as the maximum value of the sum of the numbers of in-ports and out-ports 
over all parties. 



5 Folded view and its algorithms 

View size is exponential against its depth since a view is a tree. Therefore, exponential communication bits are 
needed if the implementation simply exchanges intermediate views. Here we introduce a technique to compress 
views by sharing isomorphic subtrees of the views. We call a compressed view a folded view (or mf-view). 
The key observation is that there are at most n isomorphic subtrees in a view when the number of parties is 
n. This technique reduces not only communication complexity but also local computation time by folding all 
intermediate views and constructing larger f-views without unfolding intermediate f-views. 

In the following, we present an algorithm that constructs an f-view for each party instead of a view of 
depth (n - 1), and then describe an algorithm that counts the number of the non-isomorphic views by using 
the constructed f-view. For simplicity, we assume the underlying graph of the network is undirected. It is not 
difficult to generalize the algorithms to the case of directed network topologies as described at the end of this 
section. 



5.1 Terminology 

The folded view has all information possessed by the corresponding view. To describe such information, we 
introduce a new notion, "path set," which is equivalent to a view in the sense that any view can be reconstructed 
from the corresponding path set, and vice versa. 

A path set, Pg,o-,x(v), is defined for view T Ga - x (v). Let w roo t be the root of Tc,a-,x(v)- Suppose that every 
edge of a view is directed and its source is the end closer to w r0 ot- Pg,o-,x(v) is the set of directed labeled paths 
starting at u Ioot with infinite length in T G ^ x (v). More formally, let s(p) - (label(wo), label(<?oX label(wi), • • • ) be 
the sequence of labels of those nodes and edges which form an infinite-length directed path p = (uq, eo,u\,---) 
starting at u§(= M root ), where w; is a node, is the directed edge from w, to w, + i in Tg,<t,x(v), and label(w,) and 
label(e,) are the labels of w; and e,-, respectively. It is stressed that and e, are not node or edge identifiers, and 
are just used for definition. Pg,o-,x(v) is the set of s(p) for all p in Tq^ x {v). For T Q aX fy), we naturally define 
P^^v), i.e., the set of all sequences of labels of those nodes and edges which form directed paths of length h 
starting at w roo t in x (y). In the following, we simply call a sequence in a path set, a path, and identify the 
common length of the paths in a path set with the length of the path set. 

By the above definition, P h G x (y) is easily obtained by traversing view x (y). On the other hand, given 
P G(tX ^' we can construct the view rooted at « roo t by sharing the maximal common prefix of any pair of paths 
in P GcrX (v). In this sense, P GcrX (v) has all information possessed by view Tfi, x (v). Let be any node at 
depth j in T Q x (v), and suppose that u^ corresponds to node v u j of G. Since a view is defined recursively, we 
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can define the path set P Ga . x ( v ui) f° r tne h' -depth subtree rooted at u\ as the set of ti -length directed paths 
starting at for ti < h - j. To avoid complicated notations, we may use P Go - x (u^) instead of P G(rX (v u j)- We 
call P GcrX (u^) the path set of length ti defined for uK In particular, when ti is the length from ui to a leaf, i.e., 

h— i 

h - j, we call P GcrX (u ] ) ^ e P at ^ set defined for u J . For any node u of a view, we use depth(w) to represent the 
depth of u, i.e., the length of the path from the root to u, in the view. 

Finally, for any node u in a view and its corresponding party /, if an outgoing edge e of u corresponds to the 
communication link incident to party / via port i, we call edge e "the i-edge of u" and denote the destination of 
e by Adj ; (M). 

5.2 Folded view 

We now define a key operation, called the "merging operation," which folds a view. 

Definition 29 (Merging operation) For any pair of nodes u and u' at the same depth in a view, the merging 
operation eliminates one of the nodes, u or u' , and its outgoing edges, and redirects all incoming edges of the 
eliminated node to the remaining one, if u and u' satisfy the following conditions: (1) u and u' have the same 
label, and (2) when u and u' have outgoing edges ( i.e., neither u nor u' is a leaf), u and u' have the same number 
of outgoing edges, and the i-edges of u and u' have the same label and are directed to the same node for all i. 

Obviously, the merging operation never eliminates the root of a view. Further, the merging operation does not 
change the length of the directed path from the root to each (remaining) node. Thus, we define the depth of 
each node u that remains after applying the merging operation as the length of the path from the root to u and 
denote it again by depth(w). We call the directed acyclic graph obtained by applying the merging operation to a 
view, a folded view (f-view), and define the size of anf-view as the number of nodes in the f-view. Since views 
of finite depth are sufficient for our use, we only consider f-views that are obtained by applying the merging 
operation to views of finite depth hereafter. For any view T G ^(v), its minimal f-view is uniquely determined 

up to isomorphism as will be proved later and is denoted by T G ^(v). We can extend the definition of the path 
set to f-views: the path set of length h defined for node u in an f-view is the set of all directed labeled paths 
of length h from u in the f-view. For any node u in an f-view, we often use d u to represent the number of the 
outgoing edges of u when describing algorithms later. 
The next lemma is essential. 

Lemma 30 For any (f- )view, the merging operation does not change the path set defined for every node of the 
(f-)view if the node exists after the operation. Thus, the path set of any f-view obtained from a view by applying 
the merging operation is identical to the path set of the view. 

Proof Let u' be the node that will be merged into u (i.e., u' will be eliminated). By the definition of the merging 
operation, the set of the maximal-length directed paths starting at u is identical to the set of those starting at u' . 
Thus, by eliminating u' and redirecting all incoming edges of u' to u, the path set defined for every remaining 
node does not change. □ 

We can characterize f-views by using "path sets." Informally, for every distinct path set P defined for a node at 
any depth j in a view, any f-view obtained from the view has at least one node which defines P, at depth j. 

Before giving a formal characterization of f-views in the next lemma, we need to define some notations. 
Suppose that is any node at depth j in T Ga _ x (v). We define P J Go . x (v) as the set of path sets P g ~^ x (m- / )'s 
defined for all m ; 's. For any path set P, let P\ x be the set obtained by cutting off the first node and edge from all 
those paths in P that have x as the first edge label. 

Lemma 31 Let G f (V f , E*) be any labeled connected directed acyclic graph such that V? is the union of 
disjoint sets V? (j - 0, . . . ,ti) of nodes with - 1, is the union of disjoint sets e( c vf X v{ ' . (j - 
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0,...,h— 1) of directed edges, and every node in Vj (j — 1, . . . , h) can be reached from u r e via directed 
edges in Ef ^(v) is anf-view ofT Ga . x (y) if and only ifT^^x^ ?J ^(V^, E?) such that there is a mapping 
\li from vj onto P J G a . x (v)for each j - 0, . . . , h satisfying the following two conditions: 

CI each node u € V? has the label that is identical to the common label of the first nodes of paths in if/(u), 

C2 for each u e Vf u has an outgoing edge (u, u') with label x if and only if there is a path in if/(u) whose 
first edge is labeled with x, and if>(u') = if/(u)\ x . 

Proof (=>) We will prove that, for any f-view obtained by applying the merging operation to T G(rX (v), there 
exists if/ that satisfies CI and C2. From Lemma 30, the merging operation does not change the path set defined 
for any node (if it exists after the operation). It follows that the path set defined for any node at depth j in the 
f-view belongs to P J Go - x ^- Conversely, for every path set P in P J G x (v), there is at least one node at depth j 
in the f-view such that the path set defined for the node is P; this is because the merging operation just merges 
two nodes defining the same path set. Let ip be the mapping that maps every node u of the f-view to the path set 
defined for u. From the above argument, if/ is a mapping from V. onto P J G ^(v) and meets CI. To show that if/ 
meets C2, we use simple induction on the sequence of the merging operation. By the definition, T Q x (y) meets 
C2. Suppose that one application of the merging operation transformed an f-view to a smaller f-view, and that 
if/ meets C2 for the f-view before the operation. If we define if/' for the smaller f-view as the mapping obtained 
by restricting if/ to the node set of the smaller f-view, if/' meets C2 by the definition of the merging operation. 

(<=) We will prove that any graph for which there is if/ satisfying C 1 and C2, can be obtained by applying 
the merging operation (possibly, more than once) to T Q x (y). We can easily show by induction that the set P 

of all maximal-length labeled directed paths starting at uq e is identical to the path set P Q aX iy) of T G x (v) 
from the definition of . We will give an inversion of the merging operation that does not change P when it is 
applied to G? , and show that we can obtain the view that defines P h G x (y) by repeatedly applying the inversion 
to G^ until the inversion cannot be applied any more. This view is isomorphic to T Q x (v), since the view is 
uniquely determined for a fixed path set. It follows that G^ can be obtained from T G(rX (v) by reversing the 
sequence of the inversion, i.e., applying the merging operation repeatedly. 

The inverse operation of the merging operation is defined as follows: if some node u ] ' e vj (1 < j < h) has 
multiple incoming edges, say, e\, . . . ,e t € Ej-\, the inverse operation makes a copy u' of together with its 
outgoing edges (i.e, creates a new node u' with the same label as w 7 , and edge («', w) with label x if and only if 
edge (w 7 , w) has label x for every outgoing edge (w 7 , w) of m 7 ) and redirects ei,...,e t to u' {e\ is still directed to 
the original node w J ). Let G? = (Vf,Ef>) be the resulting graph. Consider mapping if/' such that if/ is identical 
to if/ of G? for all nodes except u' , and if/' maps u' to if/(u). Then if/' is a mapping from vj onto l P Ga . x ^ anc ^ 

meets CI and C2. The sets of maximal-length paths from uq e VI and u' e Vi are obviously identical to 
each other. Thus, the inverse operation can be applied repeatedly until there are no nodes that have multiple 
incoming edges, which does not change the set of maximal-length paths. It follows that G^ is transformed 
into a view that defines P G(rX (v), i.e., T Ga _ x (v), by repeatedly applying the operation until it can no longer be 
applied. □ 

From this lemma, we obtain the next corollary. 

Corollary 32 Any minimal f-view T Go _ x (v) is unique up to isomorphism and has exactly l^o-xOOl nodes at 
depth j (0 < j < h). The minimal f-view of depth hfor any n-party distributed system has 0(hn) nodes and 
OQiDn) edges, where D is the maximum degree over all nodes of the underlying graph. 

Proof When if/ in Lemma 31 is a bijective mapping from vj to V G ^(v) for all j, the f-view is minimal. Thus, 
the f-view has \P J G ^(v)! nodes at depth j (0 < j < h). 
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Let T x (v) and T xh (v) be any two minimal f- views of x (y), and let if/ a and i/r fc be their corresponding 
bijective mappings iff defined in Lemma 31, respectively. If we define <f> = iff ^ l iff a for the inverse mapping if/^ 1 
of if/b, is a bijective mapping from the node set of T x Jy) to that of T xb (v). Suppose that any node u a at depth 
j of T Xa (v) is mapped by iff a to some path set P in x (v), which is mapped to some node Uf, at depth j by 
if/7 1 . Obviously, u a and u\, have the same degree and have the same label as the first node of paths in P. Let 
(u a , u' a ) be an edge with any label x. Node u' a is then mapped to if/ a (u)\ x , which is mapped to node u' h incident 
to the directed edge with label x emanating from Uf,. For each u a and x, thus, there is edge (<f>(u a ), <p(u' a )) with 
label x if edge (u a , u' a ) with label x exists in T x Jy). By a similar argument, there is edge {<p~ l {ub), <p~ l {u' b )) with 
label x if edge (ub, u' b ) with label x exists in T xh (v) over all Ub and x. Thus, (f> is an isomorphism from T Xa (y) 
tof xb (v). 

For the second part of the lemma, if there are n parties, it is obvious that l^^xO-OI ^ n for any 
j (0 < j < h). Since each node has at most D outgoing edges, the lemma follows. □ 



5.3 Folded-view minimization 

The idea of the minimization algorithm is to repeatedly apply the merging operation to the (f-)view to be 
minimized until it can no longer be applied. This idea works well because of the next lemma. 

Lemma 33 Let x (y) be anf-viewfor view x (y). x (y) is isomorphic to the minimal f-view Tg x (v) 
if and only if the merging operation is not applicable to x (v). 

Proof Obviously, no more merging operations can be applied to the minimal f-view. We will prove the other 
direction in the following. Suppose that there is a non-minimal f-view T h expressing P h Ga . x {v), to which no 

more merging operations can be applied. T h must have more than \P J G (tX (v)\ nodes at depth j for some j. Let 
/ be the largest such j. From Lemma 30, for any node m 7 ' at depth / in T h , the path set defined for u->' is in 
f^^^v) if T h is an f-view of x (v). Thus, 7* must have at least one pair of nodes at depth / such that 
the path sets defined for the two nodes are identical. This implies the next facts: the two nodes have the same 
label; if f + I > h, the outgoing edges of the two nodes with the same edge label are directed to the same node 
at depth / + 1, since no two nodes at depth / + 1 have the same path set. Thus, the merging operation can still 
be applied to the node pair. This is a contradiction. □ 



5.3.1 The algorithm 

The minimization algorithm applies the merging operation to every node in the (f-)view in a bottom-up manner, 
i.e., in decreasing order of node depth. Clearly, this ensures that no application of the merging operation at any 
depth j creates a new node pair at depth larger than j to which the merging operation is applicable. Thus, no 
more merging operations can be applied when the algorithm halts. It follows that the algorithm outputs the 
minimal f-view by Lemma 33. 

In order to apply the merging operation, we need to be able to decide if two edges are directed to the same 
node, which implies that we need to identify each node. We thus assign a unique identifier, denoted by id(w), 
to each node u in the (f-)view. In order to efficiently check condition (2) of Definition 29 (i.e., the definition 
of the merging operation), we also construct a data structure for each node that includes the label of the node, 
and the labels and destination node id of all outgoing edges of the node: the data structure, called key, for 
node u is of the form of (label(w), ekey(w)). Here, label(M) is the label of u; ekey(^) is a linked list of pairs 
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(xi,yi) ■ ■ ■ (xd u ,yd u ) of the label x, and destination y ; -, respectively, of the /-edge of u for all i, where d u is the 
number of the outgoing edges of u. 

We prepare another linked list V . of all nodes at depth j for each j to make sure that the merging operation 
is applied to the set of all nodes at depth j before moving on to depth j— 1. Data structures id(w) and ekey(w) for 
every node u and V 7 . for every depth j can be constructed by one traversal of the input f-view in a breadth-first 
manner. 

We then perform the merging operation in a bottom-up manner. For each depth j from h to 1, the next op- 
erations are performed. (Notice that the algorithm terminates at j = 1 , since depth holds only the root, which 
is never removed.) First, we sort nodes u's in vj by regarding their keys, i.e., (label(w), ekey(w)) as a binary 

string, which makes all nodes having the same key adjacent to each other in V. . For each maximal subsequence 

of those nodes w's in vj which have the same pair (label(w), ekey(w)), we will eliminate all nodes but the first 
node in the subsequence and redirect all incoming edges of the eliminated nodes to the first node, which real- 
izes the merging operation. Here we introduce variables primary and primarykey to store the first node u and 
its key (label(w), ekey(w)), respectively, of the subsequence currently being processed. Concretely, we perform 
the next operation on every node u in V ■ in sorted order: if (label(w), ekey(w)) is equal to primarykey (i.e., 

conditions (1) and (2) of the merging operation are met), remove u from V. , redirect all incoming edges of u to 

primary, remove u and all its outgoing edges from T h , and set id(w) to id(primary) to make ekey consistent 
with the merger; otherwise, set primary to u and primarykey to (label(w), ekey(w)). 

More precisely, the minimization algorithm described in Figure 12 is invoked with a(n) (f-)view T h and 
its depth h (actually, h can be computed from T h , but we give h as input to simplify the algorithm). The 
minimization algorithm calls Subroutine Traversal (I) shown in Figure 13 to compute id, ekey and vj, where 
CONTINUE starts the next turn of the inner-most loop where it runs with the updated index; DEQUEUE(® removes 
an element from FIFO queue Q and returns the element; ENQUEUE(<2, q) appends element q to FIFO queue Q; 
C0N(L, appends element I to the end of list L. 

The minimization algorithm will be used as a subroutine when constructing the minimal f-view from scratch 
as described later. 

5.3.2 Time Complexity 

The next lemma states the time complexity of the minimization algorithm. 

Lemma 34 If the input of the minimization algorithm is an f-view with node set V? for an n-party distributed 
system, and any node label is represented by an 0(log L)-bit value for some positive integer L, the time com- 
plexity of the algorithm is 0(|V^|(log |V^|)(log L + D\og{D\V^\))), where D is the maximum degree of the nodes 
in the underlying graph. 

Proof We first consider Subroutine Traversal (I) in Figure 13. It is easy to see that step 1 takes constant time, 
and that step 2 takes 0(log \V^\) time. Notice that, for a standard implementation of DEQUEUE, ENQUEUE and 
CON, each call of them takes constant time. Step 3 traverses the input (f-)view in a breadth-first manner. Hence, 
the time required for step 3 is proportional to the number of edges, which is at most D|Wj. Step 3.1 takes 
constant time, while steps 3.2.2 and 3.2.3 take 6>(log \V f \). It follows that step 3 takes 0{D\V f \\og \V f \) time. 
The total time complexity of Traversal (I) is 0(D\V^\ log \V^\). 

Now we consider the minimization algorithm in Figure 12. In step 2, steps 2.2 and 2.3 are dominant. In step 
2.2, sorting all elements in vj for all j needs OflWjlog \V^\) comparisons and takes 0(logL + Dlog(D|V^|)) 
time for each comparison, since label(w) and ekey(w) have 0(logL + Dlog(D|V^|)) bits for any u (ekey(w) has 
at most D pairs of an edge label and a node id, which are [logD] bits and [log bits, respectively). Thus 
step 2.2 takes 0(|Wj(log |Wj)(log L + Dlog(D|Wj)) time. 
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F-View Minimization Algorithm 
Input: a(n) (f-)view T 1 of depth h, and a positive integer h 
Output: minimal f-view T h 

1. Call Subroutine Traversal (I) with T h , 

to compute id, ekey and vj (j = 1, . . . , h) by breadth-first traversal of T 1 '. 

2. For j := h down to 1, do the following steps. 

2.1 Initialize primarykey to an empty list. 

2.2 Sort all elements u in vj by the value obtained by regarding (label(w), ekey(w)) as a binary string. 

2.3 While V ■ + 0, repeat the following steps. 

2.3.1 Remove the first element of V ■ and set u to the element. 

2.3.2 If (label(w), ekey(w)) = primarykey, 

redirect all incoming edges of u to primary, 
eliminate u and all its outgoing edges (if they exist), and 
set id(w) := id(primary) to make ekey consistent with this merger; 
otherwise, 

set primary := u and primarykey := (label(w), ekey(w)). 

3. Output the resulting graph T h . 



Figure 12: F-view minimization algorithm. 



Step 2.3 repeats steps 2.3.1 and 2.3.2 at most |W| times, since steps 2.3.1 and 2.3.2 are each performed 
once for every node in T h except the root (the steps are never performed on the root). Clearly, each run of 
step 2.3.1 takes constant time. In each run of step 2.3.2, (a) it takes 0(logL + Dlog(D|V^|)) time to compare 
(label(M), ekey(w)) with primarykey, (b) it takes 0(dl) time to redirect all incoming edges of u to primary 
where d ! u is the number of the incoming edges of u, and (c) it takes 0(d u ) time to remove u and all its outgoing 
edges (if they exist) from T h . For more precise explanations of (b) and (c), the next data structure is assumed to 
represent T h : each u has two linked lists of incoming edges and outgoing edges such that each edge is registered 
in the incoming-edge list of its destination and the outgoing-edge list of its source, and the two entries of the 
edge lists have pointers to each other. By using this data structure, we can easily see that the edge redirection 
in (b) and the edge removal in (c) can be done in constant time for each edge, since only a constant number of 
elements need to be appended to or removed from the linked lists. 

Finally, it takes constant time to set id(w), primary and primarykey to new values. The total time required 
for step 2.3 is proportional to 



O 



\Vf\(\ogL + Dlog(D|W|)) + ^ 4 + J] du 

ueVf ueV-f > 
= O (\V f |(log L + Dlog(D\V f I)) + D\V f \ + D\V f \) , 

since no edge can be redirected or removed more than once in step 2.3.2. Hence, step 2.3 takes 0(\V^\(\og L + 
Dlog(D|V/|)) time. 

By summing up these elements, the total time complexity is given as 0(|W|(log |V^|)(logL + Dlog(D|\ / ^|)). 

□ 



34 



Subroutine Traversal (I) 

Input: a(n) (f-)view T h 

Output: id, ekey and vj ( j = l,...,h) 

— h 

1. Perform ENQUEUE(<2, u r ), where u r is the root of T and Q is a FIFO queue initialized to an empty queue. 
Set depth(w r ) := and size := 1. 

2. Set \6{u r ) := size and then set size := size + 1. 

3. While Q is not empty, repeat the following steps. 

3.1 Set u := DEQUEUE(0 and then initialize ekey{u) to an empty list. 
If u is a leaf, CONTINUE. 

3.2 For i := 1 to d u , where d u is the degree of u, 

3.2.1 Setw ; - := Adj^w). 

If u j has already been traversed, CONTINUE. 

3.2.2 Set \d(ui) := size and then set size := size + 1. 

3.2.3 Set depth(K,-) := depth(M) + 1. 

Perform C0N(v4p th(i<i ), and ENQUEUE^, Wj). 

3.2.4 Perform CON(ekey(wj, (label ((w, «,-)), id(w,-))). 

4. Output id, ekey and Vj (j - 1, . . . , h). 



Figure 13: Subroutine Traversal (I). 



5.4 Minimal folded- view construction 

We now describe the entire algorithm that constructs a minimal f-view of depth h from scratch by using the 
f-view minimization algorithm as a subroutine. This construction algorithm is almost the same as the origi- 
nal view construction algorithm except that parties exchange and perform local operations on f-views instead 
of views: every party constructs an f-view T J GcrX (v) of depth j by connecting each received minimal f-view 

Tq x (yi) of depth j - 1 with the root without unfolding them, and then applies the f-view minimization al- 
gorithm to T J GcrX (v). It is stressed that T Go _ x (v) is an f-view, since T G(rX (v) can be constructed from view 
T Go _ x (v) by applying the merging operation to every subtree rooted at depth 1. Thus, the minimization algo- 
rithm can be applied to T } G x (v). More precisely, each party / having di adjacent parties and xi as his label 
performs the f-view construction algorithm described in Figure 14 with h, d\ and xi, in which we assume that v 
is the node corresponding to party I in the underlying graph. 

Lemma 35 For any distributed system of n parties labeled with 0(log L)-bit values, the f-view construction 
algorithm described in Figure 14 constructs the minimal f-view of depth h{- 0{n)) in 0(Dh 2 n(\og «)(log Ln D )) 
time for each party and 0(\E\h 2 n log(LD D )) communication complexity, where \E\ and D are the number of 
edges and the maximum degree, respectively, of the nodes of the underlying graph. 

Proof T G ~^. x (v) has at most j • n nodes, and every node has at most D outgoing edges, each of which is labeled 
with an 0(log L)-bit value. Thus, T G ~^_ x (v) can be expressed by 0{jn log L + jDn log D) - 0{jn log(LD D )) bits. 
It follows that steps 2.1 and 2.2 take 0(jDn\og(LD D )) time, since any party has at most D neighbors. Since 
T G(rX (v) consists of a root and D minimal f-views of depth j - 1, T Go _ x (v) has at most (j • D • n + 1) nodes. 
From Lemma 34, step 2.4 in Figure 14 takes 

0(jDn logO'Dn)(log L + D \og(D ■ jDn))) = 0(jDn(\og n)(\og L + Dlog n)) 
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F-View Construction Algorithm 

Input: integers h, d and x 

Output: minimal f-view T Ga . x , where X is the underlying mapping naturally induced by the x values of all 
parties. 

1. Generate T G(rX (v), which consists of only one node with label x. 

2. For j :- 1 to h, perform the following steps. 

2.1 Send a copy of T } Ga . x (v) to every adjacent party. 

2.2 Receive the minimal f-view ^"^(v,) via port i for 1 < i < d, where v; is the node corresponding 
to the party connected via port i. 

2.3 Construct an f-view T J Ga _ x (v) from x (v,-)'s as follows. 

2.3. 1 Let root M root of T J Go . x (v) be T Go _ x (v). 

2.3.2 Let the ith child u\ of M root be the root of ^~j. z (v,). 

2.3.3 Label edge (u rooU u{) with (i, i'), where /' is the port through which v,- sent T } G ^_ x (vi), 
i.e., i' := cr[v ; ](v, v,-). _. 

2.4 Call the f-view minimization algorithm with T J G ^(v) and j to obtain T ] G(rX {v). 

3. Output f G ^(v). 



Figure 14: F-view construction algorithm. 



time for each j, since j = Thus the total time complexity is 

' h ^ 



O 



^ jDn(log «)(log L + D log n) 

7=1 



= 0(D/i 2 «(log«)(logL« D )). 



We now consider the communication complexity. Since the minimal f-view of depth j can be ex- 
pressed by 0(jn log(LD D )) bits as described above, the total number of the bits exchanged by all parties is 
0(j ■ \E\n log(LD D )) for each j. It follows that the total communication complexity to construct an f-view of 
depth h is 



( h 



O 



Y^Mn \og(LD D )) = O (\E\h 2 n \og(LD D j) . 



□ 



5.5 Counting the number of parties having specified values 

In many cases, including ours, the purpose of constructing a view is to compute |r^ _1 ^(5)| for any set S c X 
in order to compute cx(S) = n\T x '(S)\/\T X '(X)\, i.e., the number of parties having values in S. We will 
describe an algorithm that computes |r^ _1) (5)| for given minimal f-view 7^ n_1 \v), set S, and n. Hereafter, 
"a sub-f-view rooted at u" means the subgraph of an f-view induced by node u and all other nodes that can be 
reached from u via directed edges. 
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View Counting Algorithm 

Input: minimal f-view T^"~ l \v), subset 5 of the range of X, and integer n 
Output: \T { x~ l) (S)\ 

1. Call Subroutine Traversal (II) with 7^ (n_1) (v) to compute size, depth, id and id -1 . 

2. Let W be {u r \, where u r is the root of T^ n ~ l \v). 

3. For i := 2 to size, perform the next operations. 

3.1 If depth(id _1 (0) >n-\, BREAK; otherwise set u := id _1 (0- 

3.2 For each u eW, perform the next operations. 

3.2.1 Call Subroutine P with integer n, two functions (depth, id), and two sub-f-views rooted at u 
and u, in order to test if the two sub-f-views have the same path set of length n — I. 

3.2.2 Set W := W U {u} if Subroutine P outputs "No." 

4. Count the number n$ of the nodes in W that are labeled with some value in S . 

5. Output n$. 



Figure 15: View counting algorithm. 

5.5.1 View Counting Algorithm 

The algorithm computes the maximal set W of those nodes of depth of at most n - 1 in T x (v) which define 
distinct path sets of length n — 1. The algorithm then computes IT^ 1 " 1 ^)! by counting the number of those 
nodes in W which are labeled with values in S . 

To compute W, the algorithm first sets W to {u r \, where u r is the root of T^ n ~ l \v), and repeats the following 
operations for every node u of T^ n ~ l \v) at depth of at most n - 1 in a breadth-first order: For each node u in W, 
the algorithm calls Subroutine P (described later) with u and u to test if the sub-f-view rooted at u has the same 
path set of length n - 1 as that rooted at u, and sets W := W U {«} if the test is false (i.e., the two sub-f-views do 
not have the same path set of length n - 1). After processing all nodes at depth of at most n - 1, we can easily 
see that W is the maximal subset of nodes at depth of at most n - 1 such that no pair of sub-f-views rooted at 
nodes in W have a common path set of length n — 1. 

The algorithm is precisely described in Figure 15, in which Subroutine Traversal (II) is called in the first 
step in order to prepare the next objects, which helps the breadth-first traversals performed in the algorithm: (1) 
the size, denoted by size, of 7^ ( " _1) (v), (2) function depth : V f -» {0, 1, . . . , 2(n- 1)} that gives the depth of any 
node in T^ n ~ l \v), (3) bijective mapping id : V? — > {1, . . . , |Wj} that gives the order of breadth-first traversal, 
and (4) the inverse mapping id -1 of id. Although Subroutine Traversal (II) is just a breadth-first-traversal based 
subroutine, we give a precise description in Figure 16 just to support complexity analysis described later, where 
CONTINUE starts the new turn of the inner-most loop where it runs with the updated index; BREAK quits the 
inner-most loop and moves on to the next operation; DEQUEUE(0 removes an element from FIFO queue Q 
and returns the element; ENQUEUE(<2, q) appends q to Q. These operations are assumed to be implemented in a 
standard way. 

5.5.2 Subroutine P 

Subroutine P is based on the next lemma. 

Lemma 36 Suppose that and *x~b are an ^ two su ^-f -views of depth (n - 1) of a minimal f-view 
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Subroutine Traversal (II) 

Input: minimal f- view T^"~ l \v). 

Output: variable size of T^"~ l \v), and functions depth, id and id^ 1 . 

1. ENQUEUE(<2, MrootX where Q is a FIFO queue initialized to an empty queue, and w root is the root of 

Set size := 1. 

2. Set id(w root ) := size and id _1 (size) := w root . 
Set depth(w root ) := 0. 

3. Set size := size + 1. 

4. While Q is not empty, repeat the following steps. 

4.1 Setw := DEQUEUE(g). 

4.2 If u is a leaf, CONTINUE. 

4.3 For i := 1 to d u , do the following. 

4.3.1 Set := Adj^w). 

4.3.2 If Ui has already been traversed, CONTINUE. 

4.3.3 Set id(w,) := size and id _1 (size) := w,. 
Set depth(w,-) := depth(M) + 1. 

4.3.4 ENQUEUE(<2, «,-). 

4.3.5 Set size := size + 1. 

5. Output size, depth, id and id" 1 . 



Figure 16: Subroutine Traversal (II). 

T^ n (v), such that, for roots u r and w r ofT^ a Y) and T%~ b , respectively, depth(w r ) < depth(Hv) < (n — 1). 
Let V a and Vb be the vertex sets ofT^ a !) and T^ b , respectively, and let E a and Eb be the edge sets ofi£~ a 
and T^ h , respectively. 

T^ a l) and Tj^ b have a common path set of length (n - 1), if and only if there is a unique homomorphism 
(pfrom V a onto Vb such that, 

CI: for each u € V a , <p(u) has the same label as u, 

C2: for each u € V a , there is an edge-label-preserving bijective mapping from the set of outgoing edges ofu to 
the set of outgoing edges of(/>(u) such that any outgoing edge (u, u') ofu is mapped to (<p(u), <p(u')). 

Proof (=>) Let <p' : V a — > Vb be the mapping defined algorithmically as follows. We first set <p'(u r ) := w r , 
and then define <f>' by repeating the next operations for each j from to (n — 1) - 1: for every node u e V a of 
depth (J + depth(« r )) and every edge (u, u') e E a , set <f>'(u') :- w' e Vb if (u, u') and (4>'(u),w') e Eb have 
the same label. Notice that <p'(u) has been already fixed, since the above operations proceed toward leaves in a 
breadth-first manner. 

Under the condition that T^ a l) and T*£ h l) have a common path set of length (n - 1), we will prove that cf>' is 
well-defined (i.e., the operations in the definition work well) and meets CI and C2 by induction with respect to 
depth, and then we will prove that <f>' is an onto-mapping from V a to Vb and that <f> is unique (i.e., is equivalent 
to </>'). 

Suppose that T£~ r) and have a common path set of length (n - 1). 
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The base case is as follows. Clearly, <p' is well-defined for u r , and meets CI for u r . Furthermore, u r and w r 
define the same path set of length 2(n - 1) - depth(w r ), since two views of infinite depth are isomorphic if and 
only if the two views are isomorphic up to depth (n - 1). Thus, <p' is well-defined for every node incident to an 
outgoing edge of u r (i.e., every node at depth (1 + depth(« r )), and meets C2 for u r . 

For j > 1, we assume that for any u e V a at depth of at most (j + depth(w r )), (1) (p' is well-defined, (2) (p' 
meets CI, and (3) u and <p'(u) (denoted by w) define the same path set of length (2(n - 1) - depth(w)). Further, 
we assume that (4) <f>' meets C2 for any u e V a at depth of at most ((j - 1) + depth(w r )). 

For any fixed u e V a at depth (j + depth(w r )) and every outgoing edge (u, u') e E a of u, there is a node 
w' such that (<p'(u),w') has the same label as (u, u') and u' has the same label as w', since u and w(= (p'(u)) 
define the same path set of length (2(n - 1) - depth(w)) by assumption. If (f>'(u') is set to w', (p' meets CI for 
u' and C2 for u, and u' and w' have the same path set of length (2(n - 1) - depth(w'))- To show that <p' is 
well-defined for any node at depth ((j + 1) + depth(w r )), we have to prove that, for any two nodes u\ and 112 
at depth j + depth(« r ), there are no two edges from u\ and 112, respectively, destined to some identical node, 
or, (ui,u'), (U2, u') e E a , that induce two distinct images of u' by <p> (while performing the operations given in 
the definition of <p'). We assume that such two edges exist and let w\ and w' 2 be the distinct images of u' . This 

... . _2(n-l)-depth(w'), , . . . , . , ri 2(n-l)-depth(w') / , . , , _ . . , . , 

implies that path set P x (w\) is identical to P x (w 2 ), since both of them are identical to 

the path set of length 2(n- l)-depth(w' 1 ) (= 2(n-\)-dep{h(w' 2 )) defined for u' . This contradicts Corollary 32, 
since w\ and w' 2 are nodes at the same depth of minimal f-view T x n ~ l \v). This complete the proof that <p' is 
well-defined and meets CI and C2. 

We now prove that <p' is an onto-mapping. Assume that 0' is not an onto-mapping; there is at least one node 
in Vb \ |0'(w) I u e V a }- Let w be the node of the smallest depth in Vj, \ {<p'{u) \ u e V a ). Thus, for each edge of 
Eb into w, its source is in {<f>'(u) \ u e V a }. Since the source satisfies C2, w needs to be in {<p'{u) \ u e V a }. This 
is a contradiction. 

Finally, we prove the uniqueness of (p. We assume that there are two different homomorphisms, <p\ and 
(f>2, satisfying CI and C2; there is at least one node u in V a such that 0i(m) = w\ + W2 = <pi{u). Since any 
(n - l)-length directed path in emanates from w r , <pi(u r ) = <j>2{u r ) - w r . For any directed path from u r 

to u, 0i and fa define a path from w r to w\ and a path from w r to W2, respectively. By conditions CI and C2, 
these two paths are both isomorphic to the path from u r to u. Since there is at most one such path in by 
the definition of f-views, w\ must be identical to W2- This is a contradiction. 

(<=) If (f> meets CI and C2, any directed edge (u, u') in T^a^ ^ s ma PP e d by to a directed edge ((f>(u), <f>(u')) 
in T^r 1 ^ of the same edge and node labels. It follows that any directed path in T^a^ ^ s ma PP e d to an isomorphic 
directed path in Tjlb ■ Thus, any (n - l)-length directed path from u r in T^ x ~ has to be mapped to some 
isomorphic (n - l)-length directed path in '. Therefore, the path set of T^ x ~ l) is a subset of that of '. 

Conversely, fix an (n - l)-length directed path p starting at w r . Let the jth node on p be the node on p that 
can be reached via (j - 1) directed edges from w r . Since any (n - l)-length directed path in T x '~ l) is mapped 

to some (n - l)-length directed path in T^^, u r is only the preimage of w r by (f>. If u is a preimage of the 7th 
node on p with respect to (p, there is only one preimage of the (j + l)st node on p among nodes incident to the 
outgoing edges of u due to C2. By induction, the preimage of p is uniquely determined as some directed path 
from u r . Thus, the path set of f^ xh l) is a subset of that of f^ Xa l \ □ 

Lemma 36 implies that, if we can construct cp' (defined in the proof) that meets CI and C2, T^~ 1 ^ and 
have a common path set of length (n - 1). Conversely, if we cannot construct 0', there is no mapping <f> that 
satisfies CI and C2; T^ x ~ l) and T^l^ do not have a common path set of length (n- 1). As described in the proof 

of Lemma 36, (/>' can be constructed by simultaneously traversing and T^ xh l) in a breadth-first manner. 

Namely, Subroutine P first sets <p'(u r ) := w r if u r and w r have the same label, and then defines tp' by repeating 
the next operations for each j from to (n - 1) - 1. For every node u e V a of depth (j + depth(« r )), and every 
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Subroutine P 



Input: an integer n; 

function depth that gives the depth of nodes in T^ n ~ l \v), and function id; 

two sub-f-views, T^a^ roote d at u r and rooted at w r , of a minimal f-view f^ n ~ l \v) such that 

depths) < depth(Hv) < n - 1. 
Output: "Yes" or "No." 

1. Perform ENQUEUE(<2, u r ), where Q is a FIFO queue initialized to an empty queue. 

2. Set <p(u r ) := w r 

3. While Q is not empty, repeat the following steps. 

3.1 Set u := DEQUEUE(0. 

3.2 If label(w) + label(0(w)), go to step 5. 

3.3 If depth(w) = (n - 1) + depth(w,), CONTINUE. 

3.4 If <i M * dftu), go to step 5. 

3.5 Perform the next steps for i := 1 to d u . 

3.5.1 Set m := Adj ( (w) and w t := Adj z (0(w)). 

3.5.2 If label((w, «,-)) * label((0(w), w,)), go to step 5. 

3.5.3 If has already been traversed and id(0(w,-)) ^ id(w,-), go to step 5. 

3.5.4 Set 0(m,-) := w t . 

3.5.5 ENQUEUE((2,M ; ). 

4. Halt and output "Yes." 

5. Halt and output "No." 



Figure 17: Subroutine P. 

/-edge, (w, it,-) € £ a , of m, set <p'(ui) := Wj e where is the destination of /-edge of 0'( M X if (1) d u = d^ u ), 
(2) u and 0(w) have the same label, (3) (u, u\) and (<f>'(u), w,) € £2, have the same label, (4) when m has already 
been visited and thus (f>'(iij) has already been defined, <f>'(ui) is identical to w,-. 

Figure 17 gives a precise description of Subroutine P, where ENQUEUE, DEQUEUE and CONTINUE are defined 
in the same way as in the case of Subroutine Traversal (II), and are assumed to be implemented in a standard 
way. 

Lemma 37 Suppose that minimal f-view T^ n l \v) is a view of a distributed system of n parties having 
0(logL)-bit values. Given two sub-f-views T^Z^ and T^7^ of depth (n - 1) of a minimal f-view T^ n ~ l \v), 
Subroutine P outputs "Yes" if and only ifT^' ^ and T*£ b ^ have a common path set of length (n - 1). The time 
complexity is 0(n 2 \og{n D L)), where D is the maximum degree over all nodes of the underlying graph of the 
distributed system. 

Proof Subroutine P constructs <p := <p' (defined in the proof of Lemma 36). Subroutine P outputs "Yes" only 
when Q is empty, i.e., when the subroutine has already visited all nodes in T^ 1 " 1 "*- It is easy to see that, when 
Subroutine P outputs "Yes," <j> meets CI of Lemma 36 (due to step 3.2) and C2 (due to step 3.4 and step 3.5.2). 
Thus, T^xa^ an( * ^x~b ^ nave a common path set °f length (n - 1) by Lemma 36. Conversely, if T^~ 1 ^ and 
T^ h l) have a common path set of length (n - 1), the subroutine outputs "Yes," by the only-if part in the proof 
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of Lemma 36. This proves the correctness. 

Let V a and E a be the edge set and node set, respectively, of T^ a 1) . Step 3 is obviously dominant in terms 
of time complexity. Step 3.1 takes just constant time for each evaluation. Step 3.2 takes O(logL) time for each 
u since node labels are 0(logL)-bit values; it takes 0(|V a |logL) time in total. Step 3.3 takes 0(\ogn) time for 
each u; it takes 0(\V a \ log n) time in total. Step 3.4 takes 0{d u ) time for each u; it takes 0(\E a \) time in total. 

Next, we estimate the time complexity of step 3.5. Steps 3.5.1, 3.5.4, and 3.5.5 take constant time. Each 
execution of step 3.5.2 takes O(logD) time, since edge labels are 0(logD)-bit values. Each execution of 
step 3.5.3 takes O(logra) time, since T^ n ~ l \v) has 0(n 2 ) nodes. Since every edge is visited exactly once, 
step 3.5 takes 0(\E a \(logn + logD)) = 0(\E a \ log ri) time in total. The time complexity of step 3 is thus 
0(\V a \ log(«L) + \E a \ log n); this is 0(n 2 log(Ln D )) since \V a \ = 0(n 2 ) and \E a \ = 0(n 2 D). □ 



5.5.3 Analysis of View Counting Algorithm 

The correctness and complexity of the view counting algorithm is described in the next lemmas. 

Lemma 38 Given a minimal f-view T^ n l \v), a subset S of the range ofX, and the number, n, of parties, the 
view counting algorithm in Figure 15 correctly outputs l \S)\. 

Proof Let C be the collection of distinct path sets of length (n - 1) defined for all nodes m ; at depth j in minimal 
f-view T^ n ~ l \v) over all j < n - 1, and let C be the counterpart of C for (original) view T^ n ~ l \v). Suppose 
that % and n' s are the numbers of those path sets in C and C, respectively, of which the first node is labeled 
with some value in 5. Since Lemma 37 implies that % is equal to the number n$ of the nodes in W that are 
labeled with values in S , the lemma holds if we prove % = n' s and^ = |rJ _1) (S)|. 

Recall mapping ip defined in the proof of Lemma 31: for any given f-view, if/ maps every node u of the 
f-view to the path set defined for u. As described in the proof of Corollary 32, ifr is a bijective mapping from 
the set of nodes of depth j to ^o-x^ v ^' wnen the corresponding f-view is minimal. Thus, C is identical to C, 
implying % = n' s . 

The fact that n' s - \r^~ r) (S)\ is obtained from the following two properties: (1) two path sets are identical 
to each other if and only if the corresponding two views are isomorphic to each other; (2) the first node of the 
path set has the same label as the root of the corresponding view. □ 



Lemma 39 For a given distributed system of n parties, each of which has a value of 0(log L) bits, the view 
counting algorithm in Figure 15 can compute \Y^ l \S)\for any subset S of the range of X from T^ n l \v) in 
0(n 5 \og{n D L)) time, where D is the maximum degree over all nodes of the underlying graph. 

Proof We first consider Subroutine Traversal (II) in Figure 16, which is called in the first step of the view 
counting algorithm. The dominant part of Subroutine Traversal (II) is step 4, which just performs a simple 
breadth-first traversal of (v). The traversal takes 0(log \V^\) time for each edge. Thus, the time complex- 

ity of the subroutine, i.e., the time complexity of step 1 in the view counting algorithm, is 0(« 2 Dlog \V^\). 

Next we analyze step 3 of the view counting algorithm in Figure 15, which is clearly dominant in terms 
of time complexity. We can see that (1) |W| is at most n since there are n parties in the system, and (2) there 
are 0(n 2 ) nodes whose depth is at most n - 1 in T^ n ~ x \v) since there are at most n nodes at each depth. 
Hence, Subroutine P is called for each of 0(n 3 ) pairs of sub-f-views. Since one call of Subroutine P takes 
0(n 2 log(« D L)) time by Lemma 37, step 3.2 thus takes 0(n 5 log(n D L)) time; the other operations can be 
perfomed with the same order of the time complexity. The total time complexity is thus 0(n 5 log(« D L)). □ 
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5.6 Directed network topologies 

As in the case of an undirected network, Norris's theorem can be proved to be still valid in the case of a directed 
network in almost the same way as the original proof. 

Theorem 40 (Norris [34]) Suppose that there is any n-party distributed system whose underlying graph G is 
directed and strongly connected. For any nodes, v andv', ofG, Tg,o-,x(v) - Tg >0 -,x(v') if and only ifT G ~^ x (v) - 

jn-\ , ,s 
1 G,cr,X^ v >• 

(The proof is given in the appendix.) 

Therefore, it is sufficient to count the number of non-isomorphic views of depth n - 1 in order to count the 
number of non-isomorphic views of infinite depth; a natural idea is that, as in the case of undirected network 
topologies, every party constructs an f-view of depth 2(n - 1) and then counts the number of non-isomorphic 
views of depth n - 1 . This idea can work well for the next reason. 

An f-view is obtained by just sharing isomorphic subgraphs of a view; the f-view construction algorithm in 
Figure 14 does not care whether the view is derived from a directed network or an undirected network. Thus, 
the f-view construction algorithm works well for networks whose underlying graphs are directed and strongly 
connected. It is obvious that the complexity in the directed network case is the same order as in the undirected 
network case, since it depends only on the number of nodes and edges of the underlying graph, and the number 
of bits used to represent node and edges labels. 

As for the view-counting algorithm in Figure 15, it is easy to see that Lemma 36 does not depend on the 
fact that the underlying topology is undirected except for Norris's theorem. Since, as stated above, Norris's 
theorem is still valid in the case of directed networks, the view counting algorithm works well. 

6 Conclusion 

It is well-known that LE„ in an anonymous network cannot be solved classically in a deterministic sense for a 
certain broad class of network topologies such as regular graphs, even if all parties know the exact number of 
parties. This paper proposed two quantum algorithms that exactly solve LE„ for any topology of anonymous 
networks when each party initially knows the number of parties, but does not know the network topology. The 
two algorithms have their own characteristics. 

The first algorithm is simpler and more efficient in time and communication complexity than the second 
one: it has 0(n 3 ) time complexity for each party and 0(n 4 ) communication complexity. 

The second algorithm is more general than the first one, since it can work even on networks whose under- 
lying graph is directed. Moreover, the second algorithm is better than the first one in terms of some complexity 
measures. It has the total communication complexity of 0(« 6 (log n) 2 ), but involves the quantum communica- 
tion of just 0(n 2 log n) qubits of one round, while the first algorithm requires quantum communication of 0(n 4 ) 
qubits. It runs in 0(n log n) rounds, while the first one runs in 0(n 2 ) rounds. 

As for local computation time, the second algorithm requires 0(« 6 (log n) 2 ) time for each party. To attain 
this level of time and communication complexity, we introduced folded view, a view compression technique 
that enables views to be constructed in polynomial time and communication. The technique can be used to 
deterministically check if the unique leader is selected or not in polynomial time and communication and linear 
rounds in the number of parties. Furthermore, the technique can also be used to compute any symmetric 
Boolean function, i.e., any Boolean function that depends only on the Hamming weight of input in {0, 1}", on 
anonymous networks, when every party is given one of the n bits of the function's input. 

Our leader election algorithms can exactly solve the problem even when each party initially knows only the 
upper bound of the number of parties, whereas, in this setting for any topology with cycles, it was proved that 
no zero-error probabilistic algorithms exist. 
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Our algorithms use unitary gates depending on the number of parties that are eligible to be a leader during 
their execution. Thus, the algorithms require a set of elementary unitary gates whose cardinality is linear in the 
number, n, of parties. From a practical point of view, however, it would be desirable to perform leader election 
for any n by using a fixed and constant-sized set of elementary unitary gates. It is open as to whether the leader 
election problem can, in an anonymous network, be exactly solved in the quantum setting by using that set of 
gates. 

It would also be interesting to improve the upper bound and find a lower bound, of the complexity of 
solving the problem. In general, however, it is difficult to optimize both communication complexity and round 
complexity (i.e., the number of rounds required). A reasonable direction is to clarify the tradeoff between 
them. As for communication complexity, quantum communication cost per qubit would be quite different from 
classical communication cost per bit. Hence, it is also a natural open question as to what tradeoff between 
quantum and classical communication complexity exists, and how many qubits need to be communicated. 

It is also open whether the problem can be solved by a processor terminating algorithm (i.e., an algorithm 
that terminates when every party enters a halting state) in the quantum setting even without knowing the upper 
bound of the number of parties. In this situation, there are just message terminating algorithms with bounded 
error in the classical setting. 
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Appendix: Proof of Theorem 40 



Suppose that the underlying directed graph of the distributed system is G - (V,E). Let 7T& be the partition 
induced on V by the isomorphism of views T x (v) of depth k for v € V. Obviously, nk+\ is a refinement of 7!>, 
i.e., if v and w are in distinct blocks of /!>, then they are in distinct blocks of n^+i. 

Proof of Theorem 40 By Lemma 41, which will be stated later, there is some k > such that < \nj+i \ for 
every j < k, and |/r ; | = ky+i | for every j > k, where \jtj\ is the number of blocks in nj. Thus, n > \iXk\ > k + |/rol ^ 
k + 1, implying jt < n - 1. Therefore, if r£ _1 (v) = r£ _1 (w), then T x (v) = T x (w). 

Conversely, if T x ~ l (v) £ T x ~ l (w), it is obvious that T x (v) £ T x (w). □ 



Lemma 41 If n^-i - itkfor some k > 0, then nj = nufor all j > k. 

Proof Assume that n\ ± n^\. Then, there are a pair of nodes v and w such that T x (v) = T x (w) and T x +l (v) £ 
T x +1 (w). We will prove the next claim. 

Claim 42 Suppose that k > 1 is such that T x (v) - T x (w) but T x +l (v) £ T x +[ (w) for some nodes v and w in 
V. Then there are children s and t of the roots ofT x (v) and T x (w), respectively, such that T x ~ l (s) - T x ~ l (t) 
but T x (s) £ T x (t), where s and t are the nodes of the underlying directed graph, corresponding to s and t, 
respectively. 

By this claim, ± nt+i implies that nt-i + nt, which is a contradiction. Thus, if n^-i - for some k > 0, 
then iik = Kk+i- By induction, the lemma holds. □ 

Proof of Claim 42 Let ft be any isomorphism from T x (v) to T x (w). Let v and w be the roots of T x (v) and T x (w), 
respectively. Then, for any child s of v, T x ~ l (s) = T x ~ x (fi{s)), where s and fi(s) are the nodes in V corresponding 
to s and fi(s). 

We assume that, for every child s of v, there exists isomorphism fi s from T x {s) to T x (J3(s)). We define a 
new map yS' such that fi'(v) = /3(v) = w and fi'(u) - fi s (u) for every node u in T x (s) for each child s of v. It is 
easy to see that f3 s (s) - fi(s) for each s, since only s and (3(s) are the sources of the ^-length directed path in 
T x (s) and T x (J3{s)), respectively. Thus, /?' is isomorphism from T x +l (v) to T x +l (w). This is a contradiction. 
Thus, the claim holds. □ 
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